Elastic low stable eql

Access Control List Modification via setfacl

This rule detects Linux Access Control List (ACL) modification via the setfacl command. Attackers may use the setfacl utility to modify file and directory permissions in order to evade detection and maintain persistence on a compromised system.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name == "setfacl" and not (
  ?process.parent.executable in (
    "/opt/puppetlabs/puppet/bin/ruby", "/usr/libexec/dirsrv/ds_systemd_ask_password_acl", "/usr/lib/systemd/systemd-udevd",
    "/usr/bin/udevadm", "/usr/sbin/ds_systemd_ask_password_acl", "/usr/bin/su", "/bin/su"
  ) or
  process.command_line == "/bin/setfacl --restore=-" or
  process.args == "/var/log/journal/" or
  ?process.parent.name in ("stats.pl", "perl", "find") or
  ?process.parent.command_line like~ "*ansible*" or
  ?process.parent.args == "/opt/audit-log-acl.sh"
)

Field Validations

Loading…

Comments (0)

Loading comments...