Remove Immutable File Attribute via chattr - Auditd

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

This rule detects attempts to remove the immutable file attribute on Linux systems using the 'chattr' command with the '-i' flag. The immutable attribute prevents a file from being modified, deleted, or renamed, even by the root user. Adversaries may remove this attribute to modify critical system files or logs for defense evasion purposes.