Detection rules › Splunk

Windows File and Directory Permissions Enable Inheritance

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic detects the enabling of permission inheritance using ICACLS. This analytic identifies instances where ICACLS commands are used to enable permission inheritance on files or directories. The /inheritance:e flag, which restores inherited permissions from a parent directory, is monitored to detect changes that might reapply broader access control settings. Enabling inheritance can indicate legitimate administrative actions but may also signal attempts to override restrictive custom permissions, potentially exposing sensitive files to unauthorized access.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: tstats

tstats WHERE Processes.process="*/inheritance:e*" Processes.process_name IN ("cacls.exe", "icacls.exe", "xcacls.exe") BY Processes.action, Processes.dest, Processes.original_file_name, Processes.parent_process, Processes.parent_process_exec, Processes.parent_process_guid, Processes.parent_process_id, Processes.parent_process_name, Processes.parent_process_path, Processes.process, Processes.process_exec, Processes.process_guid, Processes.process_hash, Processes.process_id, Processes.process_integrity_level, Processes.process_name, Processes.process_path, Processes.user, Processes.user_id, Processes.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Processes.processeq
  • "*/inheritance:e*"
Processes.process_namein
  • "cacls.exe" corpus 3 (splunk 3)
  • "icacls.exe" corpus 3 (splunk 3)
  • "xcacls.exe" corpus 3 (splunk 3)