{"id":"T1222.001","name":"Windows Permissions","url":"https://attack.mitre.org/techniques/T1222/001","tactics":["defense-impairment"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0418","stix_id":"x-mitre-detection-strategy--a1b25828-57bf-470c-8f47-8ad4e1f6bbdb","name":"Windows DACL Manipulation Behavioral Chain Detection Strategy","url":"https://attack.mitre.org/detectionstrategies/DET0418","analytics":[{"id":"AN1177","stix_id":"x-mitre-analytic--7e4ac594-c46c-4c7e-ba6d-9a457ab1e767","name":"Analytic 1177","description":"Multi-stage Windows DACL manipulation behavioral chain: (1) Process creation of permission-modifying utilities (icacls.exe, takeown.exe, attrib.exe, cacls.exe) or PowerShell ACL cmdlets, (2) Command-line analysis revealing privilege escalation intent through suspicious parameters (/grant, /takeown, /T, Set-Acl), (3) DACL modification events (4670) correlating with process execution, (4) Subsequent file access attempts (4663) indicating successful permission bypass, (5) Potential follow-on persistence or lateral movement activities","url":"https://attack.mitre.org/detectionstrategies/DET0418#AN1177","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0066","data_component_name":"Active Directory Object Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4656, 4658","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:WMI","channel":"EventCode=5857, 5858, 5860, 5861","data_component":"DC0008","data_component_name":"WMI Creation","log_source_slug":"wineventlog-wmi"}],"mutable_elements":[{"field":"TemporalCorrelationWindow","description":"Time window for correlating process creation (4688/sysmon 1) with DACL changes (4670) and subsequent access (4663) - default 300 seconds, adjust based on system performance and network latency"},{"field":"SensitivePathWhitelist","description":"Environment-specific critical directories requiring enhanced monitoring (e.g., C:\\Windows\\System32, C:\\Program Files, %USERPROFILE%\\AppData) - customize per organizational security requirements"},{"field":"AuthorizedAdministratorAccounts","description":"User accounts and service accounts authorized to perform legitimate DACL modifications - update to reflect current administrative staff and automated processes"},{"field":"SuspiciousCommandLinePatterns","description":"Regex patterns for detecting malicious intent in permission modification commands - tune to reduce false positives while maintaining detection efficacy"},{"field":"BusinessHoursThreshold","description":"Time-based risk scoring modifier for permission changes occurring outside standard business hours - adjust based on organizational work patterns"},{"field":"PowerShellScriptBlockSizeThreshold","description":"Minimum PowerShell script block size for ACL-related content analysis - balance between detection coverage and log volume"},{"field":"FileAccessFrequencyBaseline","description":"Statistical baseline for normal file access patterns post-permission change - establish through historical analysis and update periodically"},{"field":"WMIMethodInvocationWhitelist","description":"Approved WMI classes and methods for legitimate permission operations (e.g., Win32_SecurityDescriptor) - maintain based on authorized management tools"}],"live":true,"detection_strategies":["DET0418"],"techniques":["T1222.001"]}],"live":true,"version":"1.0","techniques":["T1222.001"]}],"sigma_rules":[{"id":"028c7842-4243-41cd-be6f-12f3cf1a26c7","title":"AD Object WriteDAC Access","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"critical","date":"2019-09-12","modified":"2021-11-27","description":"Detects WRITE_DAC access to a domain object","references":["https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html","https://threathunterplaybook.com/library/windows/active_directory_replication.html","https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.defense-impairment","attack.t1222.001"],"path":"rules/windows/builtin/security/win_security_ad_object_writedac_access.yml","techniques":["T1222.001"],"cves":[]},{"id":"37ae075c-271b-459b-8d7b-55ad5f993dd8","title":"File or Folder Permissions Modifications","author":"Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-10-23","modified":"2023-11-21","description":"Detects a file or folder's permissions being modified or tampered with.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md","https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh750728(v=ws.11)","https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1222.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_susp_file_permission_modifications.yml","techniques":["T1222.001"],"cves":[]},{"id":"41d40bff-377a-43e2-8e1b-2e543069e079","title":"WannaCry Ransomware Activity","author":"Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro","status":"test","level":"critical","date":"2019-01-16","modified":"2025-10-18","description":"Detects WannaCry ransomware activity","references":["https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100","https://x.com/nas_bench/status/1868639048484425963"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.defense-impairment","attack.t1210","attack.discovery","attack.t1083","attack.t1222.001","attack.impact","attack.t1486","attack.t1490","detection.emerging-threats"],"path":"rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml","techniques":["T1210","T1083","T1222.001","T1486","T1490"],"cves":[]},{"id":"554601fb-9b71-4bcc-abf4-21a611be4fde","title":"Suspicious Recursive Takeown","author":"frack113","status":"test","level":"medium","date":"2022-01-30","modified":"2022-11-21","description":"Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1222.001"],"path":"rules/windows/process_creation/proc_creation_win_takeown_recursive_own.yml","techniques":["T1222.001"],"cves":[]},{"id":"c0b2768a-dd06-4671-8339-b16ca8d1f27f","title":"Potentially Suspicious NTFS Symlink Behavior Modification","author":"frack113, The DFIR Report","status":"test","level":"medium","date":"2022-03-02","modified":"2025-11-13","description":"Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.\n","references":["https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware","https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior","https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.defense-impairment","attack.t1059","attack.t1222.001"],"path":"rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml","techniques":["T1059","T1222.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}