doas cannot stat a file due to permissions.

Description

match=": Permission denied$"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 51550 doas grouping anchor level 0
   decoded_as=doas
2. 51551 doas cannot stat a file. anchor level 1
   match="cannot stat"
3. 51552 doas cannot stat a file due to permissions. refinement level 2 this rule
   match=": Permission denied$"

Rule dependencies

Depends on

• composes · Wazuh if_sid 51551
  • doas cannot stat a file.