Sigma rule: Potential Suspicious Change To Sensitive/Critical Files

Rule

Title

Potential Suspicious Change To Sensitive/Critical Files

Status

test

Level

medium

Author

@d4ns4n_ (Wuerth-Phoenix)

Date

2023-05-30

Modified

2026-03-18

File

rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.
These files include, but are not limited to, system configuration files, authentication files, and critical application files.
Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.

Log source

product

linux

category

process_creation

Detection

selection_img_1:
    Image|endswith:
        - '/cat'
        - '/echo'
        - '/grep'
        - '/head'
        - '/more'
        - '/tail'
    CommandLine|contains: '>'
selection_img_2:
    Image|endswith:
        - '/emacs'
        - '/nano'
        - '/sed'
        - '/vi'
        - '/vim'
selection_paths:
    CommandLine|contains:
        - '/bin/login'
        - '/bin/passwd'
        - '/boot/'
        - '/etc/*.conf'
        - '/etc/cron.' # Covers different cron config files "daily", "hourly", etc.
        - '/etc/crontab'
        - '/etc/hosts'
        - '/etc/init.d'
        - '/etc/sudoers'
        - '/opt/bin/'
        - '/sbin' # Covers: '/opt/sbin', '/usr/local/sbin/', '/usr/sbin/'
        - '/usr/bin/'
        - '/usr/local/bin/'
filter_main_mdadm.conf:
    Image|endswith: '/bin/sed'
    CommandLine|startswith:
        - 'sed -i /^*'
        - 'sed -ne s/^'
    CommandLine|endswith: '/etc/mdadm/mdadm.conf'
condition: 1 of selection_img_* and selection_paths and not 1 of filter_main_*

False positives (as the rule lists them)

• Some false positives are to be expected on user or administrator machines. Apply additional filters as needed.

Tags

• attack.impact
• attack.t1565.001

MITRE ATT&CK ids this rule names

• T1565.001

References

• https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml