Sigma rule: Chmod Targeting Sensitive Directories

Rule

Title

Chmod Targeting Sensitive Directories

Status

test

Level

medium

Author

Christopher Peacock @SecurePeacock, SCYTHE @scythe_io

Date

2022-06-03

Modified

2026-03-18

File

rules/linux/process_creation/proc_creation_lnx_chmod_targeting_sensitive_directories.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects chmod targeting files in sensitive directory paths on Linux systems.
Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.

Log source

product

linux

category

process_creation

Detection

selection:
    Image|endswith: '/chmod'
    CommandLine|contains:
        - '/tmp/'
        - '/.Library/'
        - '/etc/'
        - '/opt/'
filter_main_update_shells:
    CommandLine|contains: 'chmod --reference=/etc/shells'
    ParentCommandLine|endswith: '/update-shells'
filter_main_postinst:
    CommandLine|contains: '/etc/'
    ParentCommandLine|contains|all:
        - '/var/lib/dpkg/info/'
        - '.postinst configure'
filter_main_apt_key:
    CommandLine|startswith: 'chmod 700 /tmp/apt-key-gpghome.'
filter_main_mkinitramfs:
    CommandLine|startswith: 'chmod 755 /var/tmp/mkinitramfs'
filter_main_landscape:
    CommandLine: 'chmod 0775 /etc/landscape/'
filter_main_ubuntu_apparmor:
    CommandLine: 'chmod 644 /etc/apparmor.d/tunables/home.d/ubuntu'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Some false positives are to be expected. Apply additional filters as needed before pushing to production.

Tags

• attack.defense-impairment
• attack.t1222.002

MITRE ATT&CK ids this rule names

• T1222.002

References

• https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_chmod_targeting_sensitive_directories.yml