File and Directory Permissions Modification: Linux and Mac Permissions T1222.002
Tactic: Defense Impairment
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Events covered
5 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| ESF | exec | Process Execution |
| ESF | fork | Process Fork |
| Linux-Auditd | Event ID 1309 | EXECVE |
| Linux-Auditd | Event ID 1327 | PROCTITLE |
| Sysmon-for-Linux | Event ID 1 | Process Create |
Authoring guide
These 23 rules share fields, values, and exclusions.
Fields filtered most (25 distinct)
These fields appear most often in rule filters.
Top indicator values (242 distinct)
These values appear most often in rule predicates.
Exclusions (219 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 4 rules
- Chmod Targeting Sensitive Directories
- File or Folder Permissions Change
- Remove Immutable File Attribute
- Remove Immutable File Attribute - Auditd
Elastic 14 rules
- Access Control List Modification via setfacl
- Chattr Execution from Unusual Parent
- Chattr Execution with Unusual Target File
- Executable Bit Set for Potential Persistence Script
- File Creation in World-Writable Directory by Unusual Process
- File Execution Permission Modification Detected via Defend for Containers
- File Made Executable via Package Install Script
- File made Immutable by Chattr
- File Permission Modification in Writable Directory
- Potential Unauthorized Access via Wildcard Injection Detected
- Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities
- Shared Memory File Turned Executable by Suspicious Parent
- Suspicious File Made Executable via Chmod Inside A Container
- System Binary Path File Permission Modification