Cross-source coverage

T1222.002 / ATT&CK

File and Directory Permissions Modification: Linux and Mac Permissions

33 rules across 7 sources.

From MITRE ATT&CK 19.2

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Most Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: chown (short for change owner), and chmod (short for change mode).

Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Unix Shell Configuration Modification or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.

Platforms
Linux · macOS
Telemetry
auditd:SYSCALLauditd:PROCTITLElinux:osquerymacos:unifiedlogfs:fseventsOpenBSM:AuditTrail

How MITRE says to detect it DET0351

Unix-like File Permission Manipulation Behavioral Chain Detection Strategy

Linux Analytic 0998

Linux permission escalation behavioral chain: (1) Process creation of permission modification utilities (chmod, chown, chgrp, setfacl) with suspicious parameters indicating privilege escalation intent, (2) System call analysis revealing direct file metadata manipulation (chmod, fchmod, chown, fchown syscalls), (3) Extended attribute and ACL modifications targeting critical system paths, (4) Temporal correlation with subsequent file access or process execution from modified locations, (5) Anomalous permission patterns deviating from system baselines

  • auditd:SYSCALL syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, lchown, setxattr, lsetxattr, fsetxattr, removexattr, lremovexattr, fremovexattr)
  • auditd:PROCTITLE proctitle contains chmod, chown, chgrp, setfacl, or attr with suspicious parameters (777, 755, +x, -R)
  • linux:osquery process execution events for permission modification utilities with command-line analysis

macOS Analytic 0999

macOS permission and attribute manipulation behavioral chain: (1) Process execution of permission utilities (chmod, chown, chgrp) or macOS-specific tools (chflags) with suspicious parameters, (2) System Integrity Protection (SIP) bypass attempts through permission modifications, (3) File flags manipulation (uchg, schg, hidden) for evasion or persistence, (4) Extended attribute (xattr) modifications affecting security metadata, (5) Unified log correlation with file system events and subsequent access patterns, (6) Gatekeeper and code signing bypass through permission/attribute manipulation

  • macos:unifiedlog process execution events for chmod, chown, chflags with parameter analysis and target path examination
  • fs:fsevents file system events indicating permission, ownership, or extended attribute changes on critical paths. File system modification events with kFSEventStreamEventFlagItemChangeOwner, kFSEventStreamEventFlagItemXattrMod flags
  • OpenBSM:AuditTrail BSM audit events for file permission, ownership, and attribute modifications with user context

View on attack.mitre.org ↗

elastic/detection-rules

10 rules
Detection Severity Format
File Permission Modification in Writable Directory High Elastic TOML
Executable Bit Set for Potential Persistence Script Medium Elastic TOML
File Creation in World-Writable Directory by Unusual Process Medium Elastic TOML
File made Immutable by Chattr Medium Elastic TOML
Potential Unauthorized Access via Wildcard Injection Detected Medium Elastic TOML
Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities Medium Elastic TOML
Access Control List Modification via setfacl Low Elastic TOML
File Execution Permission Modification Detected via Defend for Containers Low Elastic TOML
Suspicious File Made Executable via Chmod Inside A Container Low Elastic TOML
System Binary Path File Permission Modification Low Elastic TOML

socfortress/Wazuh-Rules

7 rules
Detection Severity Format
chattr used to remove immutable attribute - T1222.002 High Wazuh XML
chmod used recursively on directory - T1222.002 High Wazuh XML
chown used recursively - T1222.002 High Wazuh XML
chown used to change file/folder ownership - T1222.002 High Wazuh XML
chflags used to modify immutable flag - T1222.002 Medium Wazuh XML
chmod used to change file/folder permissions (numeric mode) - T1222.002 Medium Wazuh XML
chmod used to change file/folder permissions (symbolic mode) - T1222.002 Medium Wazuh XML

SigmaHQ/sigma

4 rules
Detection Severity Format
Chmod Targeting Sensitive Directories Medium Sigma
Remove Immutable File Attribute Medium Sigma
Remove Immutable File Attribute - Auditd Medium Sigma
File or Folder Permissions Change Low Sigma

elastic/protections-artifacts

4 rules
Detection Severity Format
Chattr Execution from Unusual Parent Undefined Elastic TOML
Chattr Execution with Unusual Target File Undefined Elastic TOML
File Made Executable via Package Install Script Undefined Elastic TOML
Shared Memory File Turned Executable by Suspicious Parent Undefined Elastic TOML

splunk/security_content

4 rules
Detection Severity Format
Linux Auditd Change File Owner To Root Undefined SPL
Linux Auditd File Permission Modification Via Chmod Undefined SPL
Linux Auditd File Permissions Modification Via Chattr Undefined SPL
Linux Change File Owner To Root Undefined SPL

Wazuh Core Ruleset

2 rules
Detection Severity Format
has been denied permission to at . · match (?i)update access record.+denied Low Wazuh XML
has been granted permission to at . · match (?i)update access record.+allowed Low Wazuh XML

falcosecurity/rules

2 rules
Detection Severity Format
Mkdir binary dirs High Falco YAML
Modify binary dirs High Falco YAML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.