Linux auditd: chmod/chown process execution indicating file or folder permission changes

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1222.002Linux and Mac Permissions
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux processes executing chmod or chown, which modify file and folder permissions/ownership. Attackers may use these changes to weaken access controls, persist, or hinder incident response by altering who can read, write, or execute files. Telemetry relies on auditd EXECVE events capturing process command-line/argument data for chmod and chown.

Reporting behind it

Related detections7 linkedT1222.002 — drag to rearrange

Suspicious Making a File Executable in a Temp Directory (via process_creation)

Suspicious File Immutability Manipulation via chattr

Suspicious Download to tmp Followed by chmod Execution on Linux

Malicious Immutable Flag on SSH authorized_keys via chattr

Linux: chattr Used to Remove Immutable File Attribute

Linux chmod Process Commandlines Targeting Sensitive Directory Paths

Linux auditd: Detect chattr -i removing immutable file attribute

Linux auditd: chmod/chown process execution indicating file or folder permission changes

Pivot detection · T1222.002 · 7 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-chmod-and-chown-executions-indicating-file-or-folder-permission-cha-74c01ace

title: "Linux auditd: chmod/chown process execution indicating file or folder permission changes"
id: edcac7f3-4eb8-4dcc-a588-1d80d1044187
status: test
description: This rule flags Linux processes executing chmod or chown, which modify file and folder permissions/ownership. Attackers may use these changes to weaken access controls, persist, or hinder incident response by altering who can read, write, or execute files. Telemetry relies on auditd EXECVE events capturing process command-line/argument data for chmod and chown.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_file_or_folder_permissions.yml
author: Jakob Weinzettl, oscd.community, Huntrule Team
date: 2019-09-23
modified: 2021-11-27
tags:
  - attack.defense-impairment
  - attack.t1222.002
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0|contains:
      - chmod
      - chown
  condition: selection
falsepositives:
  - User interacting with files permissions (normal/daily behaviour).
level: low
license: DRL-1.1
related:
  - id: 74c01ace-0152-4094-8ae2-6fd776dd43e5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL