Elastic Security Detection Rules

File Permission Modification in Writable Directory

Last updated a month ago on 2024-10-17
Created 5 years ago on 2020-04-21

About

Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution.
Tags
Domain: EndpointOS: LinuxUse Case: Threat DetectionTactic: Defense EvasionData Source: Elastic Defend
Severity
low
Risk Score
21
MITRE ATT&CK™

Defense Evasion (TA0005)(opens in a new tab or window)

↳ File and Directory Permissions Modification (T1222)(opens in a new tab or window)

False Positive Examples
Certain programs or applications may modify files or change ownership in writable directories. These can be exempted by username.
License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-endpoint.events.*
Related Integrations

endpoint(opens in a new tab or window)

Query
host.os.type:linux and event.category:process and event.type:start and
process.name:(chattr or chgrp or chmod or chown) and process.working_directory:(/dev/shm or /tmp or /var/tmp) and
not process.parent.name:(apt-key or update-motd-updates-available or apt-get)

Install detection rules in Elastic Security

Detect File Permission Modification in Writable Directory in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).