Linux auditd: Detect chattr removing the immutable (-i) attribute

Flags Linux processes using chattr to remove the immutable (-i) file attribute via auditd execve telemetry.

FreeUnreviewedSigmamediumv1

linux-auditd-detect-chattr-removing-the-immutable-i-attribute-a5b977d6

title: "Linux auditd: Detect chattr removing the immutable (-i) attribute"
id: 5678d1bf-bb79-4d7f-ac0f-9b0c93681d1f
status: test
description: This rule alerts when an executable invocation includes 'chattr' and the immutable flag is being removed (argument contains '-i'). Removing the immutable attribute can allow tampering with files that are otherwise protected from modification. Telemetry relies on auditd capturing execve-style process execution details and matching the command and arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_chattr_immutable_removal.yml
author: Jakob Weinzettl, oscd.community, Huntrule Team
date: 2019-09-23
modified: 2022-11-26
tags:
  - attack.defense-impairment
  - attack.t1222.002
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0|contains: chattr
    a1|contains: -i
  condition: selection
falsepositives:
  - Administrator interacting with immutable files (e.g. for instance backups).
level: medium
simulation:
  - type: atomic-red-team
    name: Remove immutable file attribute
    technique: T1222.002
    atomic_guid: e7469fe2-ad41-4382-8965-99b94dd3c13f
license: DRL-1.1
related:
  - id: a5b977d6-8a81-4475-91b9-49dbfcd941f7
    type: derived

What it detects

This rule alerts when an executable invocation includes 'chattr' and the immutable flag is being removed (argument contains '-i'). Removing the immutable attribute can allow tampering with files that are otherwise protected from modification. Telemetry relies on auditd capturing execve-style process execution details and matching the command and arguments.

Known false positives

Administrator interacting with immutable files (e.g. for instance backups).

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.