Techniques › T1222.002 › AN0998
AN0998 Analytic 0998
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Linux permission escalation behavioral chain: (1) Process creation of permission modification utilities (chmod, chown, chgrp, setfacl) with suspicious parameters indicating privilege escalation intent, (2) System call analysis revealing direct file metadata manipulation (chmod, fchmod, chown, fchown syscalls), (3) Extended attribute and ACL modifications targeting critical system paths, (4) Temporal correlation with subsequent file access or process execution from modified locations, (5) Anomalous permission patterns deviating from system baselines</p>
- Detects
- T1222.002 Linux and Mac Permissions
- Part of
- DET0351 Unix-like File Permission Manipulation Behavioral Chain Detection Strategy
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, lchown, setxattr, lsetxattr, fsetxattr, removexattr, lremovexattr, fremovexattr) | DC0059 File Metadata |
| auditd:PROCTITLE | proctitle contains chmod, chown, chgrp, setfacl, or attr with suspicious parameters (777, 755, +x, -R) | DC0064 Command Execution |
| linux:osquery | process execution events for permission modification utilities with command-line analysis | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SuspiciousPermissionValues | Octal permission values indicating potential malicious intent - customize based on organizational security policy (default: 777, 755, 4755, 2755, 1755 for sticky/setuid/setgid) |
CriticalSystemPaths | Linux filesystem paths requiring enhanced permission change monitoring - adapt to environment-specific critical directories (/etc, /usr/bin, /usr/sbin, /var, /opt, /root, /boot) |
AuthorizedSystemAdministrators | User accounts and service accounts authorized for system-level permission modifications - maintain current list of legitimate administrators |
TemporalCorrelationWindow | Time window for correlating permission changes with subsequent file access or process execution - adjust based on system performance (default: 300 seconds) |
RecursiveOperationThreshold | Maximum depth or file count for recursive permission operations before triggering anomaly detection (-R flag monitoring) |
ACLComplexityBaseline | Baseline complexity metrics for setfacl operations to detect anomalous extended ACL configurations |
FileAccessFrequencyBaseline | Statistical baseline for normal file access patterns post-permission modification to detect privilege abuse |