File Metadata

contextual information about a file, including attributes such as the file's name, size, type, content (e.g., signatures, headers, media), user/owner, permissions, timestamps, and other related properties. File metadata provides insights into a file's characteristics and can be used to detect malicious activity, unauthorized modifications, or other anomalies. Examples:

• File Ownership and Permissions: Checking the owner and permissions of a critical configuration file like /etc/passwd on Linux or C:\Windows\System32\config\SAM on Windows.
• Timestamps: Analyzing the creation, modification, and access timestamps of a file.
• File Content and Signatures: Extracting the headers of an executable file to verify its signature or detect packing/obfuscation.
• File Attributes: Analyzing attributes like hidden, system, or read-only flags in Windows.
• File Hashes: Generating MD5, SHA-1, or SHA-256 hashes of files to compare against threat intelligence feeds.
• File Location: Monitoring files located in unusual directories or paths, such as temporary or user folders.

This data component can be collected through the following measures:

Windows

• Sysinternals Tools: Use AccessEnum or PSFile to retrieve metadata about file access and permissions.
• Windows Event Logs: Enable object access auditing and monitor events like 4663 (Object Access) and 5140 (A network share object was accessed).
• PowerShell: Use Get-Item or Get-ChildItem cmdlets: Get-ChildItem -Path "C:\Path\To\Directory" -Recurse | Select-Object Name, Length, LastWriteTime, Attributes

Linux

• File System Commands: Use ls -l or stat to retrieve file metadata: stat /path/to/file
• Auditd: Configure audit rules to log metadata access: auditctl -w /path/to/file -p wa -k file_metadata
• Filesystem Integrity Tools: Tools like tripwire or AIDE (Advanced Intrusion Detection Environment) can monitor file metadata changes.

macOS

• FSEvents: Use FSEvents to track file metadata changes.
• Endpoint Security Framework (ESF): Capture metadata-related events via ESF APIs.
• Command-Line Tools: Use ls -l or xattr for file attributes: ls -l@ /path/to/file

SIEM Integration

• Forward file metadata logs from endpoint or network devices to a SIEM for centralized analysis.