AN0834 Analytic 0834

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Sequential behavioral chain of privilege escalation through permission modification: (1) Process creation of permission-modifying utilities (icacls, takeown, attrib, cacls), (2) Correlation with unusual user context or timing, (3) DACL modification events targeting sensitive files/directories, (4) Subsequent file access or modification attempts indicating successful privilege bypass</p>

Detects: T1222 File and Directory Permissions Modification
Part of: DET0299 Multi-Platform File and Directory Permissions Modification Detection Strategy

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Security	`EventCode=4688`	DC0032 Process Creation
WinEventLog:Security	`EventCode=4663, 4670, 4656`	DC0059 File Metadata
WinEventLog:Security	`EventCode=4663, 4670, 4656`	DC0066 Active Directory Object Modification
WinEventLog:Sysmon	`EventCode=11`	DC0039 File Creation
WinEventLog:PowerShell	`EventCode=4103, 4104, 4105, 4106`	DC0064 Command Execution

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`TimeWindow`	Temporal correlation window for linking permission modification with subsequent access attempts (default: 300 seconds)
`SensitivePathList`	Environment-specific critical file and directory paths requiring permission change monitoring
`TrustedUserContext`	Administrative accounts authorized to perform legitimate permission modifications
`BusinessHoursThreshold`	Time-based threshold for elevated alerting on permission changes outside business hours

KEV CVEs whose mapped technique this analytic detects

CVE	Vendor / product	State
CVE-2022-22960	VMware Multiple Products	Mapped