Potential Persistence via File Modification
This rule leverages the File Integrity Monitoring (FIM) integration to detect file modifications of files that are commonly used for persistence on Linux systems. The rule detects modifications to files that are…
Description
This rule leverages the File Integrity Monitoring (FIM) integration to detect file modifications of files that are commonly used for persistence on Linux systems. The rule detects modifications to files that are commonly used for cron jobs, systemd services, message-of-the-day (MOTD), SSH configurations, shell configurations, runtime control, init daemon, passwd/sudoers/shadow files, Systemd udevd, and XDG/KDE autostart entries. To leverage this rule, the paths specified in the query need to be added to the FIM policy in the Elastic Security app.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 11 ATT&CK techniques it maps to.
- Log source category
- event_index
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
- T1037Boot or Logon Initialization ScriptsAlso under Privilege Escalation.34 detections cover this technique
- T1098Account ManipulationAlso under Privilege Escalation.409 detections cover this technique
- T1136Create Account67 detections cover this technique
- T1543Create or Modify System ProcessAlso under Privilege Escalation.118 detections cover this technique
- T1546Event Triggered ExecutionAlso under Privilege Escalation.106 detections cover this technique
- T1547Boot or Logon Autostart ExecutionAlso under Privilege Escalation.89 detections cover this technique
- T1556Modify Authentication ProcessAlso under Defense Impairment and Credential Access.120 detections cover this technique
References
| Reference | Cited by |
|---|---|
| slayer0x.github.io/awscli/ | Only this detection cites it |
| www.elastic.co/security-labs/approaching-the-summit-on-persistence | 2 |
| www.elastic.co/security-labs/continuation-on-persistence-mechanisms | 2 |
| www.elastic.co/security-labs/primer-on-persistence-mechanisms | 27from 2 sources |
| www.elastic.co/security-labs/sequel-on-persistence-mechanisms | 22 |
| www.elastic.co/security-labs/the-grand-finale-on-linux-persistence | Only this detection cites it |
From the source
- At source
- Open at source
- Upstream identifier
- 192657ba-ab0e-4901-89a2-911d611eee98
- Tagged by the source as
- Data Source: File Integrity MonitoringDomain: EndpointNoise: MediumOS: LinuxPerformance: NormalPlatform: LinuxResources: Investigation GuideRule Type: Event Correlation (EQL)Tactic: Credential AccessTactic: Defense EvasionTactic: PersistenceTactic: Privilege EscalationUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Sep 20, 2026
- Version
- 3