From 89cb0a782a147bffbaeab78de7fbac7344113326 Mon Sep 17 00:00:00 2001
From: Rod Soto <50486899+rosplk@users.noreply.github.com>
Date: Wed, 2 Feb 2022 07:53:42 -0800
Subject: [PATCH] rod777

---
 detections/endpoint/linux_setuid_using_chmod_utility.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml
index 9c0993d9d1..ed5bffc077 100644
--- a/detections/endpoint/linux_setuid_using_chmod_utility.yml
+++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml
@@ -18,7 +18,7 @@ description: This analytic looks for suspicious chmod utility execution to enabl
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod
   OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *",
-  "* 4777 *", "* 4577 *") by Processes.dest Processes.user Processes.parent_process_name
+  "* 4777 *", "* 4577 *", "* 777 *") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`'