Techniques › T1222.001 › AN1177
AN1177 Analytic 1177
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Multi-stage Windows DACL manipulation behavioral chain: (1) Process creation of permission-modifying utilities (icacls.exe, takeown.exe, attrib.exe, cacls.exe) or PowerShell ACL cmdlets, (2) Command-line analysis revealing privilege escalation intent through suspicious parameters (/grant, /takeown, /T, Set-Acl), (3) DACL modification events (4670) correlating with process execution, (4) Subsequent file access attempts (4663) indicating successful permission bypass, (5) Potential follow-on persistence or lateral movement activities</p>
- Detects
- T1222.001 Windows Permissions
- Part of
- DET0418 Windows DACL Manipulation Behavioral Chain Detection Strategy
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Security | EventCode=4663, 4670, 4656 | DC0066 Active Directory Object Modification |
| WinEventLog:Security | EventCode=4663, 4656, 4658 | DC0059 File Metadata |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| WinEventLog:WMI | EventCode=5857, 5858, 5860, 5861 | DC0008 WMI Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TemporalCorrelationWindow | Time window for correlating process creation (4688/sysmon 1) with DACL changes (4670) and subsequent access (4663) - default 300 seconds, adjust based on system performance and network latency |
SensitivePathWhitelist | Environment-specific critical directories requiring enhanced monitoring (e.g., C:\Windows\System32, C:\Program Files, %USERPROFILE%\AppData) - customize per organizational security requirements |
AuthorizedAdministratorAccounts | User accounts and service accounts authorized to perform legitimate DACL modifications - update to reflect current administrative staff and automated processes |
SuspiciousCommandLinePatterns | Regex patterns for detecting malicious intent in permission modification commands - tune to reduce false positives while maintaining detection efficacy |
BusinessHoursThreshold | Time-based risk scoring modifier for permission changes occurring outside standard business hours - adjust based on organizational work patterns |
PowerShellScriptBlockSizeThreshold | Minimum PowerShell script block size for ACL-related content analysis - balance between detection coverage and log volume |
FileAccessFrequencyBaseline | Statistical baseline for normal file access patterns post-permission change - establish through historical analysis and update periodically |
WMIMethodInvocationWhitelist | Approved WMI classes and methods for legitimate permission operations (e.g., Win32_SecurityDescriptor) - maintain based on authorized management tools |