AN0162
Analytic 0162
Windows
Correlate unauthorized or anomalous file modifications, deletions, or metadata changes with suspicious process execution or API calls. Detect abnormal changes to structured data (e.g., database files, logs, financial records) outside expected business process activity.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=2
WinEventLog:Sysmon
EventCode=15
WinEventLog:Security
EventCode=4663, 4670, 4656
[MonitoredFilePaths]
List of critical data directories or files; environment-specific tuning required.
[TimeWindow]
Threshold for correlating process execution with rapid data changes.
[AuthorizedProcesses]
Expected processes permitted to modify business-critical data.
AN0163
Analytic 0163
Linux
Detect unauthorized manipulation of log files, database entries, or system configuration files through auditd and syslog. Correlate shell commands that alter HISTFILE or data-related processes with abnormal file access patterns.
auditd:SYSCALL
open, unlink, rename: Suspicious file access, deletion, or modification of sensitive paths
linux:syslog
Unexpected SQL or application log entries showing tampered or malformed data
[WatchedDirectories]
Specific log or data directories critical to integrity; tune per organization.
[CommandExclusions]
Legitimate scripts/tools excluded from data manipulation monitoring.
AN0164
Analytic 0164
macOS
Detect manipulation of system or application files in `/Library`, `/System`, or user data directories using FSEvents and Unified Logs. Identify anomalous process execution modifying plist files, structured data, or logs outside expected update cycles.
macos:unifiedlog
Anomalous plist modifications or sensitive file overwrites by non-standard processes
macos:osquery
open, execve: Unexpected processes accessing or modifying critical files
[AllowedPlistEditors]
Whitelisted processes authorized to modify plist or configuration files.
[FileIntegrityBaseline]
Baseline hash values for key files to support integrity validation.