attack.t1222.002

Chmod Targeting Sensitive Directories

Apr 28, 2026 · attack.defense-impairment attack.t1222.002 ·

Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.

File or Folder Permissions Change

Apr 28, 2026 · attack.defense-impairment attack.t1222.002 ·

Share on:

Detects file and folder permission changes.

Remove Immutable File Attribute

Apr 28, 2026 · attack.defense-impairment attack.t1222.002 ·

Share on:

Detects usage of the 'chattr' utility to remove immutable file attribute.

Remove Immutable File Attribute - Auditd

Apr 28, 2026 · attack.defense-impairment attack.t1222.002 ·

Share on:

Detects removing immutable file attribute.