File Time Attribute Change - Linux

Title: File Time Attribute Change - Linux
Status: test
Description:Detect file time attribute change to hide new or changes to existing files.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
Author: Igor Fits, oscd.community
Date: 2020-10-15
modified:2022-11-28
Tags:

• -'attack.stealth'
• -'attack.t1070.006'

Logsource:

• product: linux
• service: auditd

Detection:
  execve:
    type: 'EXECVE'
  touch:
    - 'touch'
  selection2:
    - '-t'
    - '-acmr'
    - '-d'
    - '-r'
  condition:execve and touch and selection2
Falsepositives:
  -Unknown
Level: medium