File Modification

Changes made to a file, including updates to its contents, metadata, access permissions, or attributes. These modifications may indicate legitimate activity (e.g., software updates) or unauthorized changes (e.g., tampering, ransomware, or adversarial modifications). Examples:

• Content Modifications: Changes to the content of a configuration file, such as modifying /etc/ssh/sshd_config on Linux or C:\Windows\System32\drivers\etc\hosts on Windows.
• Permission Changes: Altering file permissions to allow broader access, such as changing a file from 644 to 777 on Linux or modifying NTFS permissions on Windows.
• Attribute Modifications: Changing a file's attributes to hidden, read-only, or system on Windows.
• Timestamp Manipulation: Adjusting a file's creation or modification timestamp using tools like touch in Linux or timestomping tools on Windows.
• Software or System File Changes: Modifying system files such as boot.ini, kernel modules, or application binaries.

This data component can be collected through the following measures:

Windows

• Event Logs: Enable file system auditing to monitor file modifications using Security Event ID 4670 (File System Audit) or Sysmon Event ID 2 (File creation time changed).
• PowerShell: Use Get-ItemProperty or Get-Acl cmdlets to monitor file properties: Get-Item -Path "C:\path\to\file" | Select-Object Name, Attributes, LastWriteTime

Linux

• File System Monitoring: Use tools like auditd with rules to monitor file modifications: auditctl -w /path/to/file -p wa -k file_modification
• Inotify: Use inotifywait to watch for real-time changes to files or directories: inotifywait -m /path/to/file

macOS

• Endpoint Security Framework (ESF): Monitor file modification events using ESF APIs.
• Audit Framework: Configure audit rules to track file changes.
• Command-Line Tools: Use fs_usage to monitor file activities: fs_usage -w /path/to/file

SIEM Tools

• Collect logs from endpoint agents (e.g., Sysmon, Auditd) and file servers to centralize file modification event data.