IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Elastic Security Solution [8.8] ›Detections and alerts ›Prebuilt rule reference
« Suspicious Symbolic Link Created Suspicious System Commands Executed by Previously Unknown Executable »

Suspicious Sysctl File Eventedit

Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl configuration files to modify kernel parameters, potentially compromising system stability, performance, or security.

Rule type: new_terms

Rule indices:

  • auditbeat-*
  • logs-auditd_manager.auditd-*

Severity: low

Risk score: 21

Runs every: 60m

Searches indices from: now-119m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • OS: Linux
  • Use Case: Threat Detection
  • Tactic: Discovery
  • Rule Type: BBR

Version: 104

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule queryedit

host.os.type:linux and event.category:file and event.action:("opened-file" or "read-file" or "wrote-to-file") and
file.path : ("/etc/sysctl.conf" or "/etc/sysctl.d" or /etc/sysctl.d/*)

Framework: MITRE ATT&CKTM

« Suspicious Symbolic Link Created Suspicious System Commands Executed by Previously Unknown Executable »