Home/ MITRE Matrix/ Defense Evasion/ T1222.002

T1222.002Linux and Mac Permissions

T1222.002 — Linux and Mac Permissions is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 5 detection use cases covering it and 1 threat-intel article citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

5Use cases

1Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1222 · File and Directory Permissions Modification

Use cases covering this technique (5)

Linux Auditd Change File Owner To Root ESCU actions · hunting P Linux Auditd File Permission Modification Via Chmod ESCU actions · hunting P Linux Auditd File Permissions Modification Via Chattr ESCU actions · hunting P Linux Change File Owner To Root ESCU actions · hunting P [LLM] Dirty Pipe (CVE-2022-0847): /etc/passwd or /etc/shadow modified by unexpected process Bespoke exploit · alerting DSΣPCS

Articles citing this technique (1)

high "Dirty Pipe" Linux vulnerability and your containerized applications (CVE-2022-0847) art-2501