T1222 File and Directory Permissions Modification
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- AD Object WriteDAC Accesscriticaltest · windows
- WannaCry Ransomware Activitycriticaltest · windows
- PowerShell Set-Acl On Windows Folder - PsScripthightest · windows
- Chmod Targeting Sensitive Directoriesmediumtest · linux
- Potentially Suspicious NTFS Symlink Behavior Modificationmediumtest · windows
- Remove Immutable File Attributemediumtest · linux
- Remove Immutable File Attribute - Auditdmediumtest · linux
- Suspicious Recursive Takeownmediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.