Detect Linux and Mac File and Directory Permissions Modification in Google Chronicle

rule t1222_002_linux_file_permission_modification {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1222.002 Linux/macOS file and directory permission modification via chmod, chown, chattr, or setfacl using dangerous modes or targeting sensitive system paths."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1222.002"
    severity = "HIGH"
    priority = "HIGH"
    created = "2025-01-01"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex(
      $e.target.process.file.full_path,
      `/(bin|usr/bin|usr/local/bin|sbin)/(chmod|chown|chattr|setfacl)$`
    )
    (
      // SUID/SGID bit setting — local privilege escalation vector
      re.regex($e.target.process.command_line, `(4755|4777|6755|6777|\+s|7777)`) or
      // World-writable permission grants
      re.regex($e.target.process.command_line, `(777|a\+w|o\+w|0777)`) or
      // Executable bit on files in world-writable staging directories
      (
        re.regex($e.target.process.command_line, `(\+x|a\+x|o\+x)`) and
        re.regex($e.target.process.command_line, `(/tmp/|/dev/shm/|/var/tmp/|/run/)`)
      ) or
      // chattr +i immutability flag — protects malicious persistence from deletion
      (
        re.regex($e.target.process.file.full_path, `chattr`) and
        re.regex($e.target.process.command_line, `\+i`)
      ) or
      // chattr -i removes immutability to permit modification of protected files
      (
        re.regex($e.target.process.file.full_path, `chattr`) and
        re.regex($e.target.process.command_line, `\-i( |$)`)
      ) or
      // chown root — escalates file ownership for privilege abuse
      (
        re.regex($e.target.process.file.full_path, `chown`) and
        re.regex($e.target.process.command_line, `(root:|:root)`)
      ) or
      // Sensitive credential and configuration file modification
      re.regex(
        $e.target.process.command_line,
        `(/etc/passwd|/etc/shadow|/etc/sudoers|\.ssh/|/etc/cron|/etc/systemd)`
      )
    )

  condition:
    $e
}