{"id":"6419afd1-3742-47a5-a7e6-b50386cd15f8","title":"Chmod Targeting Sensitive Directories","description":"Detects chmod targeting files in sensitive directory paths on Linux systems.\nAttackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.\n","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","status":"test","level":"medium","date":"2022-06-03","modified":"2026-03-18","tags":["attack.defense-impairment","attack.t1222.002"],"technique_ids":["T1222.002"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Some false positives are to be expected. Apply additional filters as needed before pushing to production."],"references":["https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md"],"source_path":"rules/linux/process_creation/proc_creation_lnx_chmod_targeting_sensitive_directories.yml","source_sha256":"3b8e2629aa49a20d63d7fd729e131cc23b1296942e3d43711ba260b482ed2192","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_chmod_targeting_sensitive_directories.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Chmod Targeting Sensitive Directories\nid: 6419afd1-3742-47a5-a7e6-b50386cd15f8\nstatus: test\ndescription: |\n    Detects chmod targeting files in sensitive directory paths on Linux systems.\n    Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.\nreferences:\n    - https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md\nauthor: 'Christopher Peacock @SecurePeacock, SCYTHE @scythe_io'\ndate: 2022-06-03\nmodified: 2026-03-18\ntags:\n    - attack.defense-impairment\n    - attack.t1222.002\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/chmod'\n        CommandLine|contains:\n            - '/tmp/'\n            - '/.Library/'\n            - '/etc/'\n            - '/opt/'\n    filter_main_update_shells:\n        CommandLine|contains: 'chmod --reference=/etc/shells'\n        ParentCommandLine|endswith: '/update-shells'\n    filter_main_postinst:\n        CommandLine|contains: '/etc/'\n        ParentCommandLine|contains|all:\n            - '/var/lib/dpkg/info/'\n            - '.postinst configure'\n    filter_main_apt_key:\n        CommandLine|startswith: 'chmod 700 /tmp/apt-key-gpghome.'\n    filter_main_mkinitramfs:\n        CommandLine|startswith: 'chmod 755 /var/tmp/mkinitramfs'\n    filter_main_landscape:\n        CommandLine: 'chmod 0775 /etc/landscape/'\n    filter_main_ubuntu_apparmor:\n        CommandLine: 'chmod 644 /etc/apparmor.d/tunables/home.d/ubuntu'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Some false positives are to be expected. Apply additional filters as needed before pushing to production.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1222.002","id":"T1222.002","name":"Linux and Mac Permissions","page":"techniques/enterprise/T1222.002/"}],"data_path":"data/detection-rules/6419afd1-3742-47a5-a7e6-b50386cd15f8.json","kind":"sigma"}