LoFP
/
t1222.002
t1222.002
Title
Tags
admin changing file permissions.
t1222
t1222.002
linux
sigma
administrator interacting with immutable files (e.g. for instance backups).
t1222
t1222.002
linux
sigma
administrator or network operator can execute this command. please update the filter macros to remove false positives.
t1003
T1003.008
t1016
t1070
t1070.004
t1136
t1136.001
t1222
t1222.002
t1485
t1547
t1547.006
t1548
t1548.001
t1548.003
t1574
t1574.006
endpoint
splunk
user interacting with files permissions (normal/daily behaviour).
t1222
t1222.002
linux
sigma