{"id":"31545105-3444-4584-bebf-c466353230d2","title":"Touch Suspicious Service File","description":"Detects usage of the \"touch\" process in service file.","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-01-11","modified":"","tags":["attack.stealth","attack.t1070.006"],"technique_ids":["T1070.006"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Admin changing date of files."],"references":["https://blogs.blackberry.com/","https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144"],"source_path":"rules/linux/process_creation/proc_creation_lnx_touch_susp.yml","source_sha256":"9441dee40004955a63a3268d8f9e7bec0a0420bae46e8b23f470169eea7a89f5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_touch_susp.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Touch Suspicious Service File\nid: 31545105-3444-4584-bebf-c466353230d2\nstatus: test\ndescription: Detects usage of the \"touch\" process in service file.\nreferences:\n    - https://blogs.blackberry.com/\n    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-11\ntags:\n    - attack.stealth\n    - attack.t1070.006\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/touch'\n        CommandLine|contains: ' -t '\n        CommandLine|endswith: '.service'\n    condition: selection\nfalsepositives:\n    - Admin changing date of files.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070.006","id":"T1070.006","name":"Timestomp","page":"techniques/enterprise/T1070.006/"}],"data_path":"data/detection-rules/31545105-3444-4584-bebf-c466353230d2.json","kind":"sigma"}