File-Integrity

Detection of Windows event log files (.evtx) created outside of standard system directories, which may indicate log tampering, data staging, or forensic evasion.

Adversaries may attempt to escalate privileges on Unix-like systems by modifying the sudoers configuration file to grant unauthorized users or groups elevated permissions.

Adversaries often delete web server access logs to destroy forensic evidence and evade detection after unauthorized activity, a behavior monitorable through file deletion events on common web server log paths.

Adversaries targeting Linux systems often execute payloads from ephemeral directories and immediately delete the binary to evade detection and hinder forensic investigation.

This threat brief covers the detection of suspicious processes modifying sensitive files on Linux systems, potentially indicating malicious attempts to persist, escalate privileges, or disrupt system operations.