Techniques › T1222 › T1222.002
T1222.002 Linux and Mac Permissions
defense impairment — Linux, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
2
analytics
4
Sigma rules tagged attack.t1222.002
0
KEV CVEs mapped here
<p>Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).</p><p>Most Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: <code>chown</code> (short for change owner), and <code>chmod</code> (short for change mode).</p><p>Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Unix Shell Configuration Modification or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0351 Unix-like File Permission Manipulation Behavioral Chain Detection Strategy v1.0
AN0998 LinuxLinux permission escalation behavioral chain: (1) Process creation of permission modification utilities (chmod, chown, chgrp, setfacl) with suspicious parameters indicating privilege escalation intent, (2) System call analysis revealing direct file metadata manipulation (chmod, fchmod, chown, fchown syscalls), (3) Extended attribute and ACL modifications targeting critical system paths, (4) Temporal correlation with subsequent file access or process execution from modified locations, (5) Anomalous permission patterns deviating from system baselinesauditd:SYSCALL
syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, lchown, setxattr, lsetxattr, fsetxattr, removexattr, lremovexattr, fremovexattr)→ DC0059 File Metadataauditd:PROCTITLEproctitle contains chmod, chown, chgrp, setfacl, or attr with suspicious parameters (777, 755, +x, -R)→ DC0064 Command Executionlinux:osqueryprocess execution events for permission modification utilities with command-line analysis→ DC0032 Process CreationTunable:SuspiciousPermissionValuesCriticalSystemPathsAuthorizedSystemAdministratorsTemporalCorrelationWindowRecursiveOperationThresholdACLComplexityBaselineFileAccessFrequencyBaselineAN0999 macOSmacOS permission and attribute manipulation behavioral chain: (1) Process execution of permission utilities (chmod, chown, chgrp) or macOS-specific tools (chflags) with suspicious parameters, (2) System Integrity Protection (SIP) bypass attempts through permission modifications, (3) File flags manipulation (uchg, schg, hidden) for evasion or persistence, (4) Extended attribute (xattr) modifications affecting security metadata, (5) Unified log correlation with file system events and subsequent access patterns, (6) Gatekeeper and code signing bypass through permission/attribute manipulationmacos:unifiedlogprocess execution events for chmod, chown, chflags with parameter analysis and target path examination→ DC0032 Process Creationfs:fseventsfile system events indicating permission, ownership, or extended attribute changes on critical paths. File system modification events with kFSEventStreamEventFlagItemChangeOwner, kFSEventStreamEventFlagItemXattrMod flags→ DC0061 File ModificationOpenBSM:AuditTrailBSM audit events for file permission, ownership, and attribute modifications with user context→ DC0059 File MetadataTunable:SIPProtectedPathsSuspiciousFileFlagsCriticalExtendedAttributesGatekeeperBypassIndicatorsApplicationBundleMonitoringUnifiedLogRetentionPeriodFSEventsFilteringThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1222.002
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-15 · logsource: product=linux category=process_creation · 34979410-e4b5-4e5d-8cfb-389fdff05c12
Detects usage of the 'chattr' utility to remove immutable file attribute.
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-03 (modified 2026-03-18) · logsource: product=linux category=process_creation · 6419afd1-3742-47a5-a7e6-b50386cd15f8
Detects chmod targeting files in sensitive directory paths on Linux systems.
Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.
Author: Jakob Weinzettl, oscd.community
· 2019-09-23 (modified 2021-11-27) · logsource: product=linux service=auditd · 74c01ace-0152-4094-8ae2-6fd776dd43e5
Detects file and folder permission changes.
Author: Jakob Weinzettl, oscd.community
· 2019-09-23 (modified 2022-11-26) · logsource: product=linux service=auditd · a5b977d6-8a81-4475-91b9-49dbfcd941f7
Detects removing immutable file attribute.
Rules tagged at the parent level (attack.t1222) 2
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-07-18 · logsource: product=windows category=ps_script · 3bf1d859-3a7e-44cb-8809-a99e066d3478
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-07-18 · logsource: product=windows category=ps_script · cae80281-ef23-44c5-873b-fd48d2666f49
Detects PowerShell scripts set ACL to of a file or a folder