Techniques › T1222
T1222 File and Directory Permissions Modification
defense impairment — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
2
Sigma rules tagged attack.t1222
1
KEV CVEs mapped here
<p>Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).</p><p>Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, Unix Shell Configuration Modification, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.</p><p>Adversaries may also change permissions of symbolic links. For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2022-22960 | VMware Multiple Products | exploitation technique | Mapped | 2022-04-15 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0299 Multi-Platform File and Directory Permissions Modification Detection Strategy v1.0
AN0834 WindowsSequential behavioral chain of privilege escalation through permission modification: (1) Process creation of permission-modifying utilities (icacls, takeown, attrib, cacls), (2) Correlation with unusual user context or timing, (3) DACL modification events targeting sensitive files/directories, (4) Subsequent file access or modification attempts indicating successful privilege bypassTunable:
TimeWindowSensitivePathListTrustedUserContextBusinessHoursThresholdAN0835 LinuxBehavioral sequence of unauthorized privilege escalation via permission modification: (1) chmod/chown/setfacl process execution with suspicious parameters, (2) Targeting of critical system files or unusual permission values, (3) Correlation with non-privileged user context or unusual timing patterns, (4) Follow-on file access indicating successful permission bypassauditd:SYSCALLsyscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr)→ DC0059 File Metadataauditd:PROCTITLEproctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters→ DC0064 Command ExecutionTunable:SuspiciousPermissionValuesCriticalPathPatternsAuthorizedAdminUsersAnomalyThresholdAN0836 macOSmacOS-specific permission modification behavioral chain: (1) chmod/chown/chflags process execution, (2) System Integrity Protection (SIP) bypass attempts, (3) Extended attribute (xattr) modifications, (4) Unified log correlation with file system events, (5) Subsequent access to previously restricted resourcesmacos:unifiedlogprocess execution events for chmod, chown, chflags with unusual parameters or targets→ DC0032 Process CreationTunable:SIPProtectedPathsSuspiciousFlagCombinationsXattrMonitoringScopeUnifiedLogRetentionAN0837 ESXiESXi hypervisor permission modification behavioral chain: (1) SSH access to ESXi host, (2) chmod/chown execution on VMFS datastore files or system configuration, (3) Modification of VM configuration files (.vmx) or virtual disk permissions, (4) Hostd service log correlation, (5) vCenter permission change events if centrally managedesxi:shellshell command execution for chmod, chown, or file permission modification on VMFS or system files→ DC0064 Command Executionesxi:vpxdpermission change operations on datastores or VMs→ DC0066 Active Directory Object ModificationTunable:AuthorizedSSHUsersCriticalVMFSPathsShellAccessTimeWindowvCenterIntegrationScope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1222
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-07-18 · logsource: product=windows category=ps_script · 3bf1d859-3a7e-44cb-8809-a99e066d3478
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-07-18 · logsource: product=windows category=ps_script · cae80281-ef23-44c5-873b-fd48d2666f49
Detects PowerShell scripts set ACL to of a file or a folder