Remove Immutable File Attribute - Auditd

Title: Remove Immutable File Attribute - Auditd
Status: test
Description:Detects removing immutable file attribute.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md
Author: Jakob Weinzettl, oscd.community
Date: 2019-09-23
modified:2022-11-26
Tags:

• -'attack.defense-impairment'
• -'attack.t1222.002'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'EXECVE'
    a0|contains: 'chattr'
    a1|contains: '-i'
  condition:selection
Falsepositives:
  -Administrator interacting with immutable files (e.g. for instance backups).
Level: medium