AN0834
Analytic 0834
Windows
Sequential behavioral chain of privilege escalation through permission modification: (1) Process creation of permission-modifying utilities (icacls, takeown, attrib, cacls), (2) Correlation with unusual user context or timing, (3) DACL modification events targeting sensitive files/directories, (4) Subsequent file access or modification attempts indicating successful privilege bypass
WinEventLog:Security
EventCode=4688
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=11
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[TimeWindow]
Temporal correlation window for linking permission modification with subsequent access attempts (default: 300 seconds)
[SensitivePathList]
Environment-specific critical file and directory paths requiring permission change monitoring
[TrustedUserContext]
Administrative accounts authorized to perform legitimate permission modifications
[BusinessHoursThreshold]
Time-based threshold for elevated alerting on permission changes outside business hours
AN0835
Analytic 0835
Linux
Behavioral sequence of unauthorized privilege escalation via permission modification: (1) chmod/chown/setfacl process execution with suspicious parameters, (2) Targeting of critical system files or unusual permission values, (3) Correlation with non-privileged user context or unusual timing patterns, (4) Follow-on file access indicating successful permission bypass
auditd:SYSCALL
syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr)
auditd:PROCTITLE
proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters
[SuspiciousPermissionValues]
Octal permission values that indicate potential malicious intent (default: 777, 755, 4755)
[CriticalPathPatterns]
Linux filesystem paths requiring enhanced monitoring (/etc/, /usr/bin/, /home/)
[AuthorizedAdminUsers]
User accounts permitted to perform system-level permission modifications
[AnomalyThreshold]
Statistical threshold for detecting unusual permission modification frequency
AN0836
Analytic 0836
macOS
macOS-specific permission modification behavioral chain: (1) chmod/chown/chflags process execution, (2) System Integrity Protection (SIP) bypass attempts, (3) Extended attribute (xattr) modifications, (4) Unified log correlation with file system events, (5) Subsequent access to previously restricted resources
macos:unifiedlog
process execution events for chmod, chown, chflags with unusual parameters or targets
fs:fsevents
file system events indicating permission or attribute changes
[SIPProtectedPaths]
macOS system paths protected by SIP that should never have permission modifications
[SuspiciousFlagCombinations]
chflags parameter combinations indicating evasive behavior (uchg, schg, hidden)
[XattrMonitoringScope]
Extended attributes to monitor for unauthorized modifications
[UnifiedLogRetention]
Log retention period for correlating permission changes with subsequent access
AN0837
Analytic 0837
ESXi
ESXi hypervisor permission modification behavioral chain: (1) SSH access to ESXi host, (2) chmod/chown execution on VMFS datastore files or system configuration, (3) Modification of VM configuration files (.vmx) or virtual disk permissions, (4) Hostd service log correlation, (5) vCenter permission change events if centrally managed
esxi:shell
shell command execution for chmod, chown, or file permission modification on VMFS or system files
esxi:hostd
host daemon events related to file or VM permission changes
esxi:vpxd
permission change operations on datastores or VMs
[AuthorizedSSHUsers]
ESXi user accounts authorized for shell access and file system operations
[CriticalVMFSPaths]
VMFS datastore paths requiring permission change monitoring
[ShellAccessTimeWindow]
Time correlation window for linking SSH access with permission modifications
[vCenterIntegrationScope]
Scope of vCenter audit event correlation with ESXi host activities