Check Linux file permission changes

[mjomha]

Description: Lists all executable and the level of permissions users/groups have on each file, helps detect backdoored binaries. Compare with an old list generated previously to spot any changes.

What The Data Shows: Lists all executable and the level of permissions users/groups have on each executable.

SQL:  

SELECT path,username,groupname,permissions,
    datetime(atime,"unixepoch","localtime") AS atime,
    datetime(ctime,"unixepoch","localtime") AS ctime,
    datetime(mtime,"unixepoch","localtime") AS mtime,sha256 
FROM suid_bin 
JOIN hash USING(path) 
JOIN file USING(path)
WHERE mode GLOB "???5";

[jnelson]

@mjomha would you consider modifying your query so that is shows the timestamps and hashes as well? Something like:

SELECT path,username,groupname,permissions,
    datetime(atime,"unixepoch","localtime") AS atime,
    datetime(ctime,"unixepoch","localtime") AS ctime,
    datetime(mtime,"unixepoch","localtime") AS mtime,sha256
FROM suid_bin
JOIN hash USING(path)
JOIN file USING(path)
WHERE mode GLOB "???5";

[mjomha]

That is perfect J!

Thanks! That shows more refine results.