Linux Process Creation: Detect touch Used on .service Files

Alerts when touch is executed with a timestamp flag on a .service file, indicating potential stealthy service manipulation.

FreeUnreviewedSigmamediumv1

linux-process-creation-detect-touch-used-on-service-files-31545105

title: "Linux Process Creation: Detect touch Used on .service Files"
id: 83cbd192-3737-4ca7-875e-5770963459c6
status: test
description: This rule flags Linux process executions where the process image ends with /touch and the command line includes “ -t ” and ends with “.service”. Attackers may use file timestamp changes on service unit files to influence service behavior or persistence while attempting to blend with normal file modifications. Telemetry relies on process creation events with image path and full command-line content.
references:
  - https://blogs.blackberry.com/
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_touch_susp.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-11
tags:
  - attack.stealth
  - attack.t1070.006
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /touch
    CommandLine|contains: " -t "
    CommandLine|endswith: .service
  condition: selection
falsepositives:
  - Admin changing date of files.
level: medium
license: DRL-1.1
related:
  - id: 31545105-3444-4584-bebf-c466353230d2
    type: derived

What it detects

This rule flags Linux process executions where the process image ends with /touch and the command line includes “ -t ” and ends with “.service”. Attackers may use file timestamp changes on service unit files to influence service behavior or persistence while attempting to blend with normal file modifications. Telemetry relies on process creation events with image path and full command-line content.

Known false positives

Admin changing date of files.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.