LoFP / t1222.002

t1222.002

Title	Tags
administrator interacting with immutable files (e.g. for instance backups).	t1222 t1222.002 linux sigma
some false positives are to be expected. apply additional filters as needed before pushing to production.	t1222 t1222.002 t1489 t1685 linux sigma
user interacting with files permissions (normal/daily behaviour).	t1222 t1222.002 linux sigma