Anvilogic high experimental spl
Modify File Attributes [splunk-unix]
chattr changes the file attributes on a Linux file system. - Threat Actor Association: TeamTNT - Atomics T1222.002 Test #9
Detection Logic
`get_endpoint_data` `get_endpoint_data_unix` TERM(chattr)
| table _time, host, user process
| bin span=1s
| stats values(*) as * by _time, host
| where match(process, "(?i)chattr")Field Validations
Loading…
Comments (0)
Loading comments...