ATT&CK coverage › Technique

File and Directory Permissions Modification: Windows File and Directory Permissions Modification T1222.001

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Events covered

4 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4662An operation was performed on an object.
Security-Auditing4688A new process has been created.
Security-Auditing5136A directory service object was modified.

Authoring guide

Patterns shared across the 16 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (21 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventID10eq 105136
ObjectClass7eq 7domainDNS, group, user, groupPolicyContainer, organizationalUnit
CommandLine5match 2, eq 2, in 1behavior, set, fsutil, /f , /r
aceAccessRights4in 4"Modify owner", "All extended rights", WP, RC, "Read permissions"
process_name3in 3"icacls.exe", "cacls.exe", "xcacls.exe"
Image2ends_with 2\powershell.exe, \cmd.exe, \pwsh.exe, \takeown.exe
aceType2in 2D, "Access denied"
AttributeLDAPDisplayName2eq 1, in 1gPCMachineExtensionNames, "scriptPath", "msDS-AllowedToDelegateTo", "msTSInitialProgram"
ObjectServer1eq 1DS
ObjectType1eq 1domainDNS, 19195a5b-6da0-11d0-afd3-00c04fd930c9
AccessMask1eq 10x40000
OriginalFileName1eq 1PowerShell.EXE, Cmd.Exe, pwsh.dll
aceObjectGuid1in 1"1131f6ab-9c07-11d1-f79f-00c04fc2dcd2", "1131f6ac-9c07-11d1-f79f-00c04fc2dcd2", "9923a32a-3607-11d2-b9be-0000f87a36b2"
aceControlAccessRights1eq 1"1131f6ab-9c07-11d1-f79f-00c04fc2dcd2", "Manage Replication Topology", "9923a32a-3607-11d2-b9be-0000f87a36b2"
admonEventType1eq 1Update

Top indicator values (84 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
EventIDeq51361022
aceAccessRightsin"Full control"34
ObjectClasseqdomainDNS34
process_namein"icacls.exe"33
process_namein"cacls.exe"33
process_namein"xcacls.exe"33
aceTypein"Access denied"22
aceTypeinD22
aceAccessRightsin"Modify permissions"23
aceAccessRightsinCR23
aceAccessRightsin"Delete all child objects"23
aceAccessRightsinCC23
aceAccessRightsin"Create all child objects"23
aceAccessRightsin"All extended rights"23
aceAccessRightsin"Write all properties"23
aceAccessRightsinWO23
aceAccessRightsin"Modify owner"23
aceAccessRightsin"Delete"23
aceAccessRightsinDT23
aceAccessRightsin"Delete subtree"23

Common exclusions (13 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

FieldKindValueRules excluding
new_aceeqold_values6
aceTypein"OD"1
aceTypein"XD"1
aceTypein"*denied*"1
aceTypein"D"1
aceTypeinOD1
aceTypeinXD1
aceTypein*denied*1
aceTypeinD1
old_valueseqnew_values1
new_valuesinold_values1
new_valuesin"{00000000-0000-0000-0000-000000000000}"1
new_valuesinpolicy_guid1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 3 rules

Splunk 13 rules