Access Control List Modification via setfacl

About

Tags

Domain: EndpointOS: LinuxUse Case: Threat DetectionTactic: Defense EvasionData Source: Elastic DefendData Source: Elastic EndgameData Source: Auditd ManagerData Source: CrowdstrikeData Source: SentinelOneLanguage: eql

Severity

low

Risk Score

21

MITRE ATT&CK™

Defense Evasion (TA0005)(opens in a new tab or window)

↳ File and Directory Permissions Modification (T1222)(opens in a new tab or window)

License

Elastic License v2(opens in a new tab or window)

Definition

Rule Type

Event Correlation Rule

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

logs-endpoint.events.*endgame-*auditbeat-*logs-auditd_manager.auditd-*logs-crowdstrike.fdr*logs-sentinel_one_cloud_funnel.*

Related Integrations

endpoint(opens in a new tab or window)

auditd_manager(opens in a new tab or window)

crowdstrike(opens in a new tab or window)

sentinel_one_cloud_funnel(opens in a new tab or window)

Query

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name == "setfacl" and not (
  process.command_line == "/bin/setfacl --restore=-" or
  process.args == "/var/log/journal/" or
  process.parent.name in ("stats.pl", "perl", "find") or
  process.parent.command_line like~ "/bin/sh -c *ansible*"
)