Skip to main content

📝 File Attribute Change

Quick Explanation​

Quick Summary: The file_attribute_change recipe identifies modifications to file attributes—a tactic frequently used by attackers to conceal malicious activities. By altering file permissions, timestamps, or ownership, adversaries can evade detection and maintain persistence on the system.

More Information​

📋 Detection Metadata​

Description: File attributes change
Tactic: Defense Evasion
Technique: File And Directory Permissions Modification
Sub-Technique: Linux And Mac File And Directory Permissions Modification
Importance: High

🔍 Event Analysis​

The file_attribute_change detection event monitors and alerts on modifications to file attributes within the system. It falls under the "Defense Evasion" category, focusing on attempts to bypass security measures as defined by the MITRE ATT&CK framework.


Specifically, this event targets changes in file attributes that could be used to conceal malicious activities or artifacts. This encompasses techniques like T1222 (File and Directory Permissions Modification), T1070 (Indicator Removal on Host), and T1562 (Impair Defenses). Attackers may change permissions, timestamps, or ownership to hide their presence or actions, prevent detection, or disable security tools.


For instance, an attacker might alter the last modified timestamp to blend in with legitimate activity or change file permissions to restrict access from security scanners.

💡 Security Implications​

🔄 CI/CD Pipeline​

In CI/CD environments, undetected file attribute changes related to a pull request could result in malicious code being merged and deployed. This may lead to security breaches or full system compromise. For example, an attacker could alter a package file’s attributes to bypass signature checks (T1036: Masquerading) or modify permissions to enable unauthorized access or persistent backdoors (T1059: Command and Scripting Interpreter).

🧪 Staging Environment​

In staging, adversarial testing could exploit attribute changes to bypass controls during deployment. Attackers might target configuration files or use altered attributes to gain elevated privileges, maintain persistence, or enable unauthorized access before production rollouts (T1098: Account Manipulation).

🚀 Production Environment​

In production, undetected attribute changes increase the risk of long-term persistence and lateral movement. Attackers may alter the permissions of critical files, steal credentials, or disable monitoring. These techniques are common with APTs to remain undetected and exfiltrate data or escalate privileges (T1074: Data Stolen).

✅ CI/CD Actions​

  1. Review and Audit Pull Requests: Implement strict code review and audit processes for any file attribute changes. Ensure modifications are justified and documented.
  2. Implement File Integrity Monitoring: Use tools to track and alert on unauthorized changes to file attributes throughout the CI/CD pipeline.
  3. Educate Developers: Provide training on the risks of attribute changes and the importance of secure coding practices.

✅ Staging Actions​

  1. Conduct Thorough Testing: Perform in-depth security testing to detect unauthorized or suspicious attribute changes.
  2. Use Configuration Management: Enforce and restore file attributes automatically using configuration management tools.
  3. Limit Access Controls: Restrict attribute modifications to authorized personnel and automate enforcement.
  4. Regularly Update Security Policies: Ensure policies and procedures include checks for attribute changes.

✅ Production Actions​

  1. Incident Response Plan: Maintain a plan that includes response steps for unauthorized attribute changes.
  2. Forensic Analysis: Investigate to determine the root cause and scope of attribute-related incidents.
  3. Regular Security Audits: Schedule audits to assess the effectiveness of controls and identify potential gaps.

🔗 Related Resources​