System File Modification (EDR Graph)
This detects file writes to sensitive system locations like /etc/, /usr/bin/, and /usr/local/bin/. These directories hold configuration files and executable programs that control how a system behaves, so unexpected changes here are a strong sign of tampering.
How the attack works
An attacker who has gained access to a system, whether through a compromised account, an exploited service, or a malicious agent action, writes or overwrites files in /etc/, /usr/bin/, or /usr/local/bin/. This can mean planting a malicious binary in a directory that is already on the system PATH, replacing a legitimate tool with a trojaned version, or altering configuration files to change system behavior or maintain access. The rule watches for these write operations at the system call level every 30 seconds, regardless of which process or user performs them.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 89404989-df81-5ae1-9b23-d9e845e9be65-p
- Severity
- Critical
Why it matters
Successful modification of these directories can give an attacker persistent access, let them run malicious code disguised as a trusted binary, or silently change system configuration to weaken security controls. This is a narrow signal covering only the file-write step, not evidence of a completed compromise on its own.
What you can do
- →Restrict write access to /etc/, /usr/bin/, and /usr/local/bin/ to trusted administrative accounts only.
- →Use file integrity monitoring or read-only filesystem mounts where feasible for these paths.
- →When a write is detected, check which process and user account performed it and whether that action was expected or authorized.
- →Review recently modified files in these directories for unexpected binaries, scripts, or configuration changes.