Query: rule covering Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linu
Matching passage: Sigma rule: Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linu. Logsource: linux / process_creation. Rule: title: Potential Suspicious Change To Sensitive/Critical Files id: 86157017-c2b1-4d4a-8c33-93b8e67e4af4 status: test description: 'Detects changes of sensitive and critical files. Monitors files that you don''t expect to change without planning on Linux system. These files include, but are not limited to, system configuration files, authentication files, and critical application files. Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations. ' references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2023-05-30 modified: 2026-03-18 tags: - attack.impact - attack.t1565.001 logsource: category: process_creation product: linux detection: selection_img_1: Image|endswith: - /cat - /echo - /grep - /head - /more - /tail CommandLine|contains: '>' selection_img_2: Image|endswith: - /emacs - /nano - /sed - /vi - /vim selection_paths: CommandLine|contains: - /bin/login - /bin/passwd - /boot/ - /etc/*.conf - /etc/cron. - /etc/crontab - /etc/hosts - /etc/init.d - /etc/sudoers - /opt/bin/ - /sbin - /usr/bin/ - /usr/local/bin/ filter_main_mdadm.conf: Image|endswith: /bin/sed CommandLine|startswith: - sed -i /^* - sed -ne s/^ CommandLine|endswith: /etc/mdadm/mdadm.conf condition: 1 of selection_img_* and selection_paths and not 1 of filter_main_* falsepositives: - Some false positives are to be expected on user or administrator machines. Apply additional filters as needed. level: medium
Near-miss passage: Sigma rule: Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation. Logsource: windows / process_creation. Rule: title: Suspicious ClickFix/FileFix Execution Pattern id: d487ed4a-fd24-436d-a0b2-f4e95f7b2635 related: - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb type: similar status: experimental description: 'Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems. ' references: - https://github.com/JohnHammond/recaptcha-phish - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/ - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2 - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-19 tags: - attack.execution - attack.t1204.001 - attack.t1204.004 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe CommandLine|contains: '#' selection_cli_captcha: CommandLine|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify condition: all of selection_* falsepositives: - Unlikely level: high