Techniques › T1222 › T1222.001
T1222.001 Windows Permissions
defense impairment — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
5
Sigma rules tagged attack.t1222.001
0
KEV CVEs mapped here
<p>Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).</p><p>Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs). Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.</p><p>Adversaries can interact with the DACLs using built-in Windows commands, such as
icacls, cacls, takeown, and attrib, which can grant adversaries higher permissions on specific files and folders. Further, PowerShell provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0418 Windows DACL Manipulation Behavioral Chain Detection Strategy v1.0
AN1177 WindowsMulti-stage Windows DACL manipulation behavioral chain: (1) Process creation of permission-modifying utilities (icacls.exe, takeown.exe, attrib.exe, cacls.exe) or PowerShell ACL cmdlets, (2) Command-line analysis revealing privilege escalation intent through suspicious parameters (/grant, /takeown, /T, Set-Acl), (3) DACL modification events (4670) correlating with process execution, (4) Subsequent file access attempts (4663) indicating successful permission bypass, (5) Potential follow-on persistence or lateral movement activitiesTunable:
TemporalCorrelationWindowSensitivePathWhitelistAuthorizedAdministratorAccountsSuspiciousCommandLinePatternsBusinessHoursThresholdPowerShellScriptBlockSizeThresholdFileAccessFrequencyBaselineWMIMethodInvocationWhitelist
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1222.001
Author: Roberto Rodriguez @Cyb3rWard0g
· 2019-09-12 (modified 2021-11-27) · logsource: product=windows service=security · 028c7842-4243-41cd-be6f-12f3cf1a26c7
Detects WRITE_DAC access to a domain object
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2019-10-23 (modified 2023-11-21) · logsource: product=windows category=process_creation · 37ae075c-271b-459b-8d7b-55ad5f993dd8
Detects a file or folder's permissions being modified or tampered with.
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
· 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079
Detects WannaCry ransomware activity
Author: frack113
· 2022-01-30 (modified 2022-11-21) · logsource: product=windows category=process_creation · 554601fb-9b71-4bcc-abf4-21a611be4fde
Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders
Author: frack113, The DFIR Report
· 2022-03-02 (modified 2025-11-13) · logsource: product=windows category=process_creation · c0b2768a-dd06-4671-8339-b16ca8d1f27f
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Rules tagged at the parent level (attack.t1222) 2
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-07-18 · logsource: product=windows category=ps_script · 3bf1d859-3a7e-44cb-8809-a99e066d3478
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-07-18 · logsource: product=windows category=ps_script · cae80281-ef23-44c5-873b-fd48d2666f49
Detects PowerShell scripts set ACL to of a file or a folder