huntrule

Linux auditd: chmod/chown process execution indicating file or folder permission changes

Flags Linux EXECVE events running chmod or chown, which commonly correspond to file/folder permission changes.

FreeReviewedSigma · Low · v3
Product
linux
Service
auditd
Author
Jakob Weinzettl, oscd.community (SigmaHQ), DRL 1.1
Published
2019-09-23
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux processes executing chmod or chown, which modify file and folder permissions/ownership. Attackers may use these changes to weaken access controls, persist, or hinder incident response by altering who can read, write, or execute files. Telemetry relies on auditd EXECVE events capturing process command-line/argument data for chmod and chown.

Reporting behind it

Related detections7 linkedT1222.002 — drag to rearrange
Suspicious Making a File Executable in a Temp Directory (via process_creation)
Suspicious File Immutability Manipulation via chattr
Suspicious Download to tmp Followed by chmod Execution on Linux
Malicious Immutable Flag on SSH authorized_keys via chattr
Linux: chattr Used to Remove Immutable File Attribute
Linux chmod Process Commandlines Targeting Sensitive Directory Paths
Linux auditd: Detect chattr -i removing immutable file attribute
Linux auditd: chmod/chown process execution indicating file or folder permission changes
Pivot detection · T1222.002 · 7 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.