Elastic low stable eql
Suspicious File Made Executable via Chmod Inside A Container
This rule detects when chmod or chown are used to add the execute permission to a file in a world-writeable directory, and inside of a container. Modifying file permissions to make a file executable could indicate malicious activity, as an attacker may attempt to run unauthorized or malicious code inside the container.
Detection Logic
process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.entry_leader.entry_meta.type == "container" and process.name in ("chmod", "chown") and
process.args in ("4755", "755", "000", "777", "444", "+x") and
process.args like ("/dev/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/mnt/*", "/media/*")Field Validations
Loading…
Comments (0)
Loading comments...