0056-rc.local-priv-rc.local Permissions Modified¶

Rule ID¶

• 0056-rc.local-priv

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitor whether the permissions of the host file /etc/rc.local have been modified.

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• The rc.local script is a script that automatically executes after a Linux system boots. Command-line instructions that need to start at boot can be added to this script.

Risk¶

• Functionality Unavailable

Audit Method¶

• Run the following command and verify that Uid and Gid are both 0/root, and permissions are 755:

stat /etc/rc.d/rc.local
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)

Remediation¶

• If the /etc/rc.local file permissions are detected to have been changed, log in to the server as root, restore the permissions, and audit the change.

Impact¶

• None

Default Value¶

• None

References¶

• Hacker Intrusion Emergency Response Ideas && Process (Unofficial)
• Record of a Real Cryptomining Intrusion Analysis (Unofficial)

CIS Controls¶

• None