Touch Suspicious Service File

Title: Touch Suspicious Service File
Status: test
Description:Detects usage of the "touch" process in service file.
References:
  -https://blogs.blackberry.com/
  -https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-01-11
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1070.006'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection:
    Image|endswith: '/touch'
    CommandLine|contains: ' -t '
    CommandLine|endswith: '.service'
  condition:selection
Falsepositives:
  -Admin changing date of files.
Level: medium