Home/ MITRE Matrix/ Defense Evasion/ T1222.002

T1222.002Linux and Mac Permissions

T1222.002 — Linux and Mac Permissions is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 7 detection use cases covering it and 2 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

7Use cases

2Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1222 · File and Directory Permissions Modification

Use cases covering this technique (7)

Linux Auditd Change File Owner To Root ESCU actions · hunting P Linux Auditd File Permission Modification Via Chmod ESCU actions · hunting P Linux Auditd File Permissions Modification Via Chattr ESCU actions · hunting P Linux Change File Owner To Root ESCU actions · hunting P [LLM] Tengu ELF-header corruption ('ELFOOD') of Linux reboot/shutdown utilities Bespoke install · hunting DSΣPCS [LLM] Tengu immutable-binary persistence via chattr +i on Linux/IoT Bespoke install · hunting DSΣPDDCS [LLM] Dirty Pipe (CVE-2022-0847): /etc/passwd or /etc/shadow modified by unexpected process Bespoke exploit · alerting DSΣPCS

Articles citing this technique (2)

high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process art-43

high "Dirty Pipe" Linux vulnerability and your containerized applications (CVE-2022-0847) art-2478