Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissio. Logsource: linux / process_creation. Rule: title: Chmod Targeting Sensitive Directories id: 6419afd1-3742-47a5-a7e6-b50386cd15f8 status: test description: 'Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations. ' references: - https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-03 modified: 2026-03-18 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux category: process_creation detection: selection: Image|endswith: /chmod CommandLine|contains: - /tmp/ - /.Library/ - /etc/ - /opt/ filter_main_update_shells: CommandLine|contains: chmod --reference=/etc/shells ParentCommandLine|endswith: /update-shells filter_main_postinst: CommandLine|contains: /etc/ ParentCommandLine|contains|all: - /var/lib/dpkg/info/ - .postinst configure filter_main_apt_key: CommandLine|startswith: chmod 700 /tmp/apt-key-gpghome. filter_main_mkinitramfs: CommandLine|startswith: chmod 755 /var/tmp/mkinitramfs filter_main_landscape: CommandLine: chmod 0775 /etc/landscape/ filter_main_ubuntu_apparmor: CommandLine: chmod 644 /etc/apparmor.d/tunables/home.d/ubuntu condition: selection and not 1 of filter_main_* falsepositives: - Some false positives are to be expected. Apply additional filters as needed before pushing to production. level: medium
Near-miss passage: Sigma rule: Detects uncommon target processes for remote thread creation. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation In Uncommon Target Image id: a1a144b7-5c9b-4853-a559-2172be8d4a03 related: - id: f016c716-754a-467f-a39e-63c06f773987 type: obsolete status: test description: Detects uncommon target processes for remote thread creation references: - https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection author: Florian Roth (Nextron Systems) date: 2022-03-16 modified: 2025-07-04 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.003 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: - \calc.exe - \calculator.exe - \mspaint.exe - \notepad.exe - \ping.exe - \sethc.exe - \spoolsv.exe - \wordpad.exe - \write.exe filter_main_csrss: SourceImage: C:\Windows\System32\csrss.exe filter_main_notepad: SourceImage: - C:\Windows\System32\explorer.exe - C:\Windows\System32\OpenWith.exe TargetImage: C:\Windows\System32\notepad.exe filter_main_sethc: SourceImage: C:\Windows\System32\AtBroker.exe TargetImage: C:\Windows\System32\Sethc.exe filter_optional_aurora_1: StartFunction: EtwpNotificationThread filter_optional_aurora_2: SourceImage|contains: unknown process filter_optional_vmtoolsd: SourceImage: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe StartFunction: GetCommandLineW TargetImage: - C:\Windows\System32\notepad.exe - C:\Windows\System32\spoolsv.exe filter_optional_xerox_pjems: SourceImage: C:\Program Files\Xerox\XeroxPrintExperience\CommonFiles\XeroxPrintJobEventManagerService.exe StartFunction: LoadLibraryW TargetImage: C:\Windows\System32\spoolsv.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium