t1222 | LoFP

t1222

Title	Tags
admin changing file permissions.	t1222 t1222.002 linux sigma
administrative activity	t1003 t1016 t1021 t1021.001 t1027 t1036 t1053 t1053.005 t1059 t1059.001 t1059.005 t1071 t1071.001 t1087 t1087.001 t1087.002 t1098 t1105 t1133 t1134 t1136 t1136.001 t1137 t1222 t1222.001 t1505 t1505.004 t1552 t1552.006 t1555 t1555.004 t1562 t1562.001 t1572 t1615 windows linux sigma
administrator interacting with immutable files (e.g. for instance backups).	t1222 t1222.002 linux sigma
administrator or network operator can execute this command. please update the filter macros to remove false positives.	t1003 T1003.008 t1016 t1070 t1070.004 t1136 t1136.001 t1222 t1222.002 t1485 t1547 t1547.006 t1548 t1548.001 t1548.003 t1574 t1574.006 endpoint splunk
administrators may use this command. filter as needed.	t1222 endpoint splunk
administrators or administrative scripts may use this application. filter as needed.	t1222 endpoint splunk
blob permissions may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1222 azure elastic
certain programs or applications may modify files or change ownership in writable directories. these can be exempted by username.	t1222 linux elastic
false positives will be present based on many factors. tune the correlation as needed to reduce too many triggers.	t1003 t1012 t1016 t1033 t1049 t1059 t1069 t1082 t1112 t1115 t1222 t1529 t1548 t1552 endpoint splunk
scripts created by developers and admins	t1071 t1071.001 t1105 t1222 t1222.001 t1567 windows linux sigma
some applications and users may legitimately use attrib.exe to interact with the files.	t1222 t1222.001 endpoint splunk
storage bucket permissions may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.	t1222 gcp elastic
takeown.exe is a normal windows application that may used by network operator.	t1222 endpoint splunk
user interacting with files permissions (normal/daily behaviour).	t1222 t1222.002 linux sigma