MITRE ATT&CK technique
File and Directory Permissions Modification detection rulesT1222
File and Directory Permissions Modification (T1222) is a MITRE ATT&CK technique in the Defense Impairment tactic. This page lists the 11 community-maintained Sigma detection rules in the library mapped to T1222 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux.
Tactic
AD Object WriteDAC Access
criticalDetects WRITE_DAC access to a domain object
windows
WannaCry Ransomware Activity
criticalDetects WannaCry ransomware activity
windows · process_creation
PowerShell Set-Acl On Windows Folder - PsScript
highDetects PowerShell scripts to set the ACL to a file in the Windows folder
windows · ps_script
Chmod Targeting Sensitive Directories
mediumDetects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.
linux · process_creation
File or Folder Permissions Modifications
mediumDetects a file or folder's permissions being modified or tampered with.
windows · process_creation
Potentially Suspicious NTFS Symlink Behavior Modification
mediumDetects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
windows · process_creation
Remove Immutable File Attribute
mediumDetects usage of the 'chattr' utility to remove immutable file attribute.
linux · process_creation
Remove Immutable File Attribute - Auditd
mediumDetects removing immutable file attribute.
linux
Suspicious Recursive Takeown
mediumAdversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders
windows · process_creation
File or Folder Permissions Change
lowDetects file and folder permission changes.
linux
PowerShell Script Change Permission Via Set-Acl - PsScript
lowDetects PowerShell scripts set ACL to of a file or a folder
windows · ps_script