File or Folder Permissions Change

Title: File or Folder Permissions Change
Status: test
Description:Detects file and folder permission changes.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md
Author: Jakob Weinzettl, oscd.community
Date: 2019-09-23
modified:2021-11-27
Tags:

• -'attack.defense-impairment'
• -'attack.t1222.002'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'EXECVE'
    a0|contains:
      -'chmod'
      -'chown'

  condition:selection
Falsepositives:
  -User interacting with files permissions (normal/daily behaviour).
Level: low