This query is designed to detect any attempts to rename the /etc/shadow file on Linux systems. The /etc/shadow file is critical because it stores hashed passwords for user accounts, and renaming it is not a normal operation. Such an action could indicate malicious activity, such as an attempt to hide unauthorized changes to user passwords.

Key Points:

• Purpose: To identify unauthorized renaming of the /etc/shadow file.
• Why it matters: Renaming this file could be a sign of malicious activity aimed at maintaining unauthorized access to the system.
• Detection Method: Monitors file events (DeviceFileEvents) for actions where:
  • The action type is "FileRenamed".
  • The file name is /etc/shadow.

Search Query:

DeviceFileEvents
| where ActionType contains "FileRenamed"
| where FileName == @"/etc/shadow"

Tags:

• File Events
• Persistence
• User Password Change
• /etc/shadow
• Linux Security
• Suspicious Activity

This query helps in identifying suspicious activities related to user password changes and potential persistence mechanisms used by threat actors on Linux systems.