T1222 File and Directory Permissions Modification
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- AD Object WriteDAC Accesscriticaltest · windows
- WannaCry Ransomware Activitycriticaltest · windows
- PowerShell Set-Acl On Windows Folder - PsScripthightest · windows
- Chmod Targeting Sensitive Directoriesmediumtest · linux
- Potentially Suspicious NTFS Symlink Behavior Modificationmediumtest · windows
- Remove Immutable File Attributemediumtest · linux
- Remove Immutable File Attribute - Auditdmediumtest · linux
- Suspicious Recursive Takeownmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.