FIM Custom rules for linux

[Calebasah]

Description

We need to design and implement a robust set of File Integrity Monitoring (FIM) custom rules for Linux endpoints to enhance detection of unauthorized system changes, persistence mechanisms, and binary tampering.

Key Objectives

• Detect unauthorized modifications to critical system files, configurations, and binaries.

• Identify persistence mechanisms used by malware or attackers (e.g., startup scripts, cron jobs, systemd units).

• Monitor sensitive directories for privilege escalation attempts.

Definition of Ready:

• Target files identified.

• False positive risk evaluated.

• Agent test environment available.

Acceptance Criteria:

• Changes to any of the files generate an alert in Wazuh.

• Alerts contain username, file path, and timestamp.

Definition of Done:

• Config pushed to repo.

• Documentation updated.

[Calebasah]

Implemented in dev.

[Calebasah]

WIP

[eva672]

checkout rules here

[Calebasah]

@eva672 and @Calebasah to take a look on the custom rules to reduce some noise