Skip to content

T1136 Create Account-File

T1136

Required Tables

  • file_events

Returned Fields

Field Description
timestamp date timestamp as a string
path the path for the file event
process_uuid unique UUID assigned to a process

Query

SELECT
    FROM_UNIXTIME(unix_nano_timestamp/1e9),
    path,
    process_uuid
FROM file_events
WHERE 
    event_type != 4
    AND path LIKE '/etc/ld.so.%'
    AND path NOT IN (
        '/usr/bin/dnf',
        '/usr/bin/dpkg',
        '/usr/bin/rpm',
        '/usr/bin/snap',
        '/usr/bin/yum'
    ) AND path NOT LIKE '%puppet' 
    AND path NOT LIKE '%chef'