ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about ATT&CKcon 7.0.
| ID | Name |
|---|---|
| T1222.001 | Windows Permissions |
| T1222.002 | Linux and Mac Permissions |
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.[1][2] File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).[3] Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.[4]
Adversaries can interact with the DACLs using built-in Windows commands, such as icacls, cacls, takeown, and attrib, which can grant adversaries higher permissions on specific files and folders. Further, PowerShell provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.
BitPaymer can use icacls /reset and takeown /F to reset a targeted executable's permissions and then take ownership.[5]
BlackByte Ransomware uses the mountvol.exe command to mount volume names and leverages the Microsoft Discretionary Access Control List tool, icacls.exe, to grant the group to "Everyone" full access to the root of the drive.[6]
BlackCat can use Windows commands such as fsutil behavior set SymLinkEvaluation R2L:1 to redirect file system access to a different location after gaining access into compromised networks.[7]
CaddyWiper can modify ACL entries to take ownership of files.[8]
Diskpart can be used to display, set, or clear attributes of a disk or volume.[9]
Grandoreiro can modify the binary ACL to prevent security tools from running.[10]
JPIN can use the command-line utility cacls.exe to change file permissions.[11]
Storm-1811 has used cacls.exe via batch script to modify file and directory permissions in victim environments.[13]
WannaCry uses attrib +h and icacls . /grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls.[14]
WastedLocker has a command to take ownership of a file and reset the ACL permissions using the takeown.exe /F filepath command.[15]
Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.[16]
| ID | Mitigation | Description |
|---|---|---|
| M1026 | Privileged Account Management |
Ensure critical system files as well as those known to be abused by adversaries have restrictive permissions and are owned by an appropriately privileged account, especially if access is not required by users nor will inhibit system functionality. |
| M1022 | Restrict File and Directory Permissions |
Applying more restrictive permissions to files and directories could prevent adversaries from modifying the access control lists. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0418 | Windows DACL Manipulation Behavioral Chain Detection Strategy | AN1177 |
Multi-stage Windows DACL manipulation behavioral chain: (1) Process creation of permission-modifying utilities (icacls.exe, takeown.exe, attrib.exe, cacls.exe) or PowerShell ACL cmdlets, (2) Command-line analysis revealing privilege escalation intent through suspicious parameters (/grant, /takeown, /T, Set-Acl), (3) DACL modification events (4670) correlating with process execution, (4) Subsequent file access attempts (4663) indicating successful permission bypass, (5) Potential follow-on persistence or lateral movement activities |