Potential Suspicious Change To Sensitive/Critical Files

detection:
  filter_main_mdadm.conf:
    CommandLine|endswith: '/etc/mdadm/mdadm.conf'
    CommandLine|startswith:
      - 'sed -i /^*'
      - 'sed -ne s/^'
    Image|endswith: '/bin/sed'
  selection_img_1:
    CommandLine|contains: '>'
    Image|endswith:
      - '/cat'
      - '/echo'
      - '/grep'
      - '/head'
      - '/more'
      - '/tail'
  selection_img_2:
    Image|endswith:
      - '/emacs'
      - '/nano'
      - '/sed'
      - '/vi'
      - '/vim'
  selection_paths:
    CommandLine|contains:
      - '/bin/login'
      - '/bin/passwd'
      - '/boot/'
      - '/etc/*.conf'
      - '/etc/cron.'
      - '/etc/crontab'
      - '/etc/hosts'
      - '/etc/init.d'
      - '/etc/sudoers'
      - '/opt/bin/'
      - '/sbin'
      - '/usr/bin/'
      - '/usr/local/bin/'
  condition: 1 of selection_img_* and selection_paths and not 1 of filter_main_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by @d4ns4n_ (Wuerth-Phoenix), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

The commands LOLBAS or GTFOBins documents for sed trip it: each is on its program’s page, read by CmdID.