{"id":"86157017-c2b1-4d4a-8c33-93b8e67e4af4","title":"Potential Suspicious Change To Sensitive/Critical Files","description":"Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.\nThese files include, but are not limited to, system configuration files, authentication files, and critical application files.\nAttackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.\n","author":"@d4ns4n_ (Wuerth-Phoenix)","status":"test","level":"medium","date":"2023-05-30","modified":"2026-03-18","tags":["attack.impact","attack.t1565.001"],"technique_ids":["T1565.001"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Some false positives are to be expected on user or administrator machines. Apply additional filters as needed."],"references":["https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor"],"source_path":"rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml","source_sha256":"81b82185eded25b7587cd200e8014457b08b061de8ddb27e48af72de078240c0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Suspicious Change To Sensitive/Critical Files\nid: 86157017-c2b1-4d4a-8c33-93b8e67e4af4\nstatus: test\ndescription: |\n    Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.\n    These files include, but are not limited to, system configuration files, authentication files, and critical application files.\n    Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.\nreferences:\n    - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor\nauthor: '@d4ns4n_ (Wuerth-Phoenix)'\ndate: 2023-05-30\nmodified: 2026-03-18\ntags:\n    - attack.impact\n    - attack.t1565.001\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_img_1:\n        Image|endswith:\n            - '/cat'\n            - '/echo'\n            - '/grep'\n            - '/head'\n            - '/more'\n            - '/tail'\n        CommandLine|contains: '>'\n    selection_img_2:\n        Image|endswith:\n            - '/emacs'\n            - '/nano'\n            - '/sed'\n            - '/vi'\n            - '/vim'\n    selection_paths:\n        CommandLine|contains:\n            - '/bin/login'\n            - '/bin/passwd'\n            - '/boot/'\n            - '/etc/*.conf'\n            - '/etc/cron.' # Covers different cron config files \"daily\", \"hourly\", etc.\n            - '/etc/crontab'\n            - '/etc/hosts'\n            - '/etc/init.d'\n            - '/etc/sudoers'\n            - '/opt/bin/'\n            - '/sbin' # Covers: '/opt/sbin', '/usr/local/sbin/', '/usr/sbin/'\n            - '/usr/bin/'\n            - '/usr/local/bin/'\n    filter_main_mdadm.conf:\n        Image|endswith: '/bin/sed'\n        CommandLine|startswith:\n            - 'sed -i /^*'\n            - 'sed -ne s/^'\n        CommandLine|endswith: '/etc/mdadm/mdadm.conf'\n    condition: 1 of selection_img_* and selection_paths and not 1 of filter_main_*\nfalsepositives:\n    - Some false positives are to be expected on user or administrator machines. Apply additional filters as needed.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1565.001","id":"T1565.001","name":"Stored Data Manipulation","page":"techniques/enterprise/T1565.001/"}],"data_path":"data/detection-rules/86157017-c2b1-4d4a-8c33-93b8e67e4af4.json","kind":"sigma"}