I dont even know pt 11

Author: sd9777

rules/linux/file_event/file_event_lnx_new_suid_file.yml

@@ -14,20 +14,13 @@ logsource:
     product: linux
     category: file_event
 detection:
-    selection_chmod:
-        CommandLine|contains:
-            - 'chmod 4755'
-            - 'chmod 4750'
-            - 'chmod 4777'
-            - 'chmod 2755'
-            - 'chmod +s'
     selection_tmp_paths:
         TargetFilename|contains:
             - '/tmp/'
             - '/usr/local/bin/'
             - '/opt/'
             - '/home/'
-    condition: selection_chmod or selection_tmp_paths
+    condition: selection_tmp_paths
 falsepositives:
     - Legitimate admin operations changing permissions.
 level: high