chmod

Linux execution T1222.002

Change file permissions. Used post-exploitation to make dropped payloads executable.

Binary Paths

  • /bin/chmod
  • /usr/bin/chmod

Glob Patterns

Pattern Notes
chmo?
Wildcard replaces 'd'
ch*d
Star matches 'mo'
c?mod
Wildcard replaces 'h'
chm[o]d
Bracket class on fourth char
/bin/chmo?
Full path wildcard
/???/bin/chmod
Directory obfuscation
c*od
Aggressive star wildcard
ch?od
Wildcard replaces 'm'

Pattern Tester

$

Try typing chmod or a full path like /bin/chmod

YARA Rule

Auto-generated detection rule for chmod

      

Resources

← Previous certutil Catalog Next → chown