From 64fcd2a6d4a394708dfd2f924ea00dd2917d2c60 Mon Sep 17 00:00:00 2001 From: Br3akp0int <26181693+tccontre@users.noreply.github.com> Date: Fri, 21 Feb 2025 09:36:11 +0100 Subject: [PATCH] Update detections/endpoint/linux_auditd_change_file_owner_to_root.yml Co-authored-by: Nasreddine Bencherchali --- detections/endpoint/linux_auditd_change_file_owner_to_root.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index a4207c03da..9d4a2a18b1 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -4,7 +4,7 @@ version: 6 date: '2025-02-20' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically monitoring command-line executions and process details. This activity is significant