File Modified for Execution

id: '1124.1202'
title: File Modified for Execution
description: 'Detect when a file has been modified to an executable file with chmod.
  -- Threat Actor Association: APT41, Mélofée, TeamTNT, UNC5221, UTA0178, WatchDog,
  Winnti Group - Software Association: Ransom Cartel -- Atomics T1059.004 Test#1 Atomics
  T1222.002 Test#1 Atomics T1222.002 Test#2 Atomics T1222.002 Test#3 Atomics T1222.002
  Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` TERM(type=EXECVE) TERM(CHMOD)
  | regex process="(?i)(^chmod\s+([-fhvrlp]+\s+)?((([01234567]{1,1})?([1357]{1,1})[01234567]{1,2}|([01234567]{1,1})[1357]{1,1}([01234567]{1,1})|([01234567]{1,2})[1357]{1,1})|[xs\+ugota\,]+)(\s+)[^\s]+)"
  | rex field=process "(?i)(^chmod\s+([-fhvrlp]+\s+)?((([01234567]{1,1})?([1357]{1,1})[01234567]{1,2}|([01234567]{1,1})[1357]{1,1}([01234567]{1,1})|([01234567]{1,2})[1357]{1,1})|[xs\+ugota\,]+)(\s+))(?<process_params>.+)"
  | rex field=process_params max_match=10 "(?i)(?<file_path>[^\s]+)" | table _time,
  host, user process, file_path, process_* | bin span=1s | stats values(*) as * by
  _time, host, process | eventstats dc(host) as dc_host by process| eventstats count
  as c_process by process| where dc_host=1 and c_process<10 '
techniques:
- execution:command and scripting interpreter:unix shell
- privilege-escalation:abuse elevation control mechanism:setuid and setgid
- defense-evasion:file and directory permissions modification:linux and mac file and
  directory permissions modification
technique_id:
- T1548.001
- T1222.002
- T1059.004
data_category:
- Process command-line parameters
- Linux audit logs
references: null