Write below etc

rule: Write below etc
desc: 'Trying to write to any file below /etc can serve as an auditing rule to track
  general system changes. Such rules can be noisy and challenging to interpret, particularly
  if your system frequently undergoes updates. However, careful profiling of your
  environment can transform this rule into an effective rule for detecting unusual
  behavior associated with system changes, including compliance-related cases.

  '
condition: write_etc_common
output: File below /etc opened for writing | file=%fd.name pcmdline=%proc.pcmdline
  gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: ERROR
tags:
- maturity_sandbox
- host
- container
- filesystem
- mitre_persistence
- T1098