Linux auditd: Suspicious chmod and file replacement via cp

title: "Linux auditd: Suspicious chmod and file replacement via cp"
id: 41584740-bc63-40a4-b24e-3e55b1b62554
status: test
description: This rule flags process execution events on Linux where chmod is used to set permissive or setuid-related modes (777 or u+s), or where cp overwrites /bin/ksh and /bin/sh. Attackers often modify executable permissions or replace common shells to gain persistence or execute malicious code under trusted paths. The detection relies on auditd EXECVE telemetry capturing the executed program name and its first argument values.
references:
  - Internal Research - mostly derived from exploit code including code in MSF
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_susp_cmds.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-12-12
modified: 2022-10-05
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  service: auditd
detection:
  cmd1:
    type: EXECVE
    a0: chmod
    a1: 777
  cmd2:
    type: EXECVE
    a0: chmod
    a1: u+s
  cmd3:
    type: EXECVE
    a0: cp
    a1: /bin/ksh
  cmd4:
    type: EXECVE
    a0: cp
    a1: /bin/sh
  condition: 1 of cmd*
falsepositives:
  - Admin activity
level: medium
license: DRL-1.1
related:
  - id: 1543ae20-cbdf-4ec1-8d12-7664d667a825
    type: derived