attack_technique: T1222.002
display_name: 'File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification'
atomic_tests:
- name: chmod - Change file or folder mode (numeric mode)
  auto_generated_guid: 34ca1464-de9d-40c6-8c77-690adf36a135
  description: |
    Changes a file or folder's permissions using chmod and a specified numeric mode.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    numeric_mode:
      description: Specified numeric mode value
      type: Integer
      default: 755
    file_or_folder:
      description: Path of the file or folder
      type: Path
      default: /tmp/AtomicRedTeam/atomics/T1222.002
  executor:
    command: |
      chmod #{numeric_mode} #{file_or_folder}
    name: bash
- name: chmod - Change file or folder mode (symbolic mode)
  auto_generated_guid: fc9d6695-d022-4a80-91b1-381f5c35aff3
  description: |
    Changes a file or folder's permissions using chmod and a specified symbolic mode.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    symbolic_mode:
      description: Specified symbolic mode value
      type: String
      default: a+w
    file_or_folder:
      description: Path of the file or folder
      type: Path
      default: /tmp/AtomicRedTeam/atomics/T1222.002
  executor:
    command: |
      chmod #{symbolic_mode} #{file_or_folder}
    name: bash
- name: chmod - Change file or folder mode (numeric mode) recursively
  auto_generated_guid: ea79f937-4a4d-4348-ace6-9916aec453a4
  description: |
    Changes a file or folder's permissions recursively using chmod and a specified numeric mode.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    numeric_mode:
      description: Specified numeric mode value
      type: Integer
      default: 755
    file_or_folder:
      description: Path of the file or folder
      type: Path
      default: /tmp/AtomicRedTeam/atomics/T1222.002
  executor:
    command: |
      chmod -R #{numeric_mode} #{file_or_folder}
    name: bash
- name: chmod - Change file or folder mode (symbolic mode) recursively
  auto_generated_guid: 0451125c-b5f6-488f-993b-5a32b09f7d8f
  description: |
    Changes a file or folder's permissions recursively using chmod and a specified symbolic mode.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    symbolic_mode:
      description: Specified symbolic mode value
      type: String
      default: a+w
    file_or_folder:
      description: Path of the file or folder
      type: Path
      default: /tmp/AtomicRedTeam/atomics/T1222.002
  executor:
    command: |
      chmod -R #{symbolic_mode} #{file_or_folder}
    name: bash
- name: chown - Change file or folder ownership and group
  auto_generated_guid: d169e71b-85f9-44ec-8343-27093ff3dfc0
  description: |
    Changes a file or folder's ownership and group information using chown.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    owner:
      description: Username of desired owner
      type: String
      default: root
    file_or_folder:
      description: Path of the file or folder
      type: Path
      default: /tmp/AtomicRedTeam/atomics/T1222.002/T1222.002.yaml
    group:
      description: Group name of desired group
      type: String
      default: root
  executor:
    command: |
      chown #{owner}:#{group} #{file_or_folder}
    name: bash
- name: chown - Change file or folder ownership and group recursively
  auto_generated_guid: b78598be-ff39-448f-a463-adbf2a5b7848
  description: |
    Changes a file or folder's ownership and group information recursively using chown.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    owner:
      description: Username of desired owner
      type: String
      default: root
    file_or_folder:
      description: Path of the file or folder
      type: Path
      default: /tmp/AtomicRedTeam/atomics/T1222.002
    group:
      description: Group name of desired group
      type: String
      default: root
  executor:
    command: |
      chown -R #{owner}:#{group} #{file_or_folder}
    name: bash
- name: chown - Change file or folder mode ownership only
  auto_generated_guid: 967ba79d-f184-4e0e-8d09-6362b3162e99
  description: |
    Changes a file or folder's ownership only using chown.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    owner:
      description: Username of desired owner
      type: String
      default: root
    file_or_folder:
      description: Path of the file or folder
      type: Path
      default: /tmp/AtomicRedTeam/atomics/T1222.002/T1222.002.yaml
  executor:
    command: |
      chown #{owner} #{file_or_folder}
    name: bash
- name: chown - Change file or folder ownership recursively
  auto_generated_guid: 3b015515-b3d8-44e9-b8cd-6fa84faf30b2
  description: |
    Changes a file or folder's ownership only recursively using chown.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    owner:
      description: Username of desired owner
      type: String
      default: root
    file_or_folder:
      description: Path of the file or folder
      type: Path
      default: /tmp/AtomicRedTeam/atomics/T1222.002
  executor:
    command: |
      chown -R #{owner} #{file_or_folder}
    name: bash
- name: chattr - Remove immutable file attribute
  auto_generated_guid: e7469fe2-ad41-4382-8965-99b94dd3c13f
  description: |
    Remove's a file's `immutable` attribute using `chattr`.
    This technique was used by the threat actor Rocke during the compromise of Linux web servers.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    file_to_modify:
      description: Path of the file
      type: Path
      default: /var/spool/cron/root
  executor:
    command: |
      chattr -i #{file_to_modify}
    name: sh
