{"id":"T1222","name":"File and Directory Permissions Modification","url":"https://attack.mitre.org/techniques/T1222","tactics":["defense-impairment"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0299","stix_id":"x-mitre-detection-strategy--682ddf59-6de3-4765-a1c0-09b539fa5d4f","name":"Multi-Platform File and Directory Permissions Modification Detection Strategy","url":"https://attack.mitre.org/detectionstrategies/DET0299","analytics":[{"id":"AN0834","stix_id":"x-mitre-analytic--0669b8b5-8888-45aa-acf8-819dfb7d00a2","name":"Analytic 0834","description":"Sequential behavioral chain of privilege escalation through permission modification: (1) Process creation of permission-modifying utilities (icacls, takeown, attrib, cacls), (2) Correlation with unusual user context or timing, (3) DACL modification events targeting sensitive files/directories, (4) Subsequent file access or modification attempts indicating successful privilege bypass","url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0834","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0066","data_component_name":"Active Directory Object Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"TimeWindow","description":"Temporal correlation window for linking permission modification with subsequent access attempts (default: 300 seconds)"},{"field":"SensitivePathList","description":"Environment-specific critical file and directory paths requiring permission change monitoring"},{"field":"TrustedUserContext","description":"Administrative accounts authorized to perform legitimate permission modifications"},{"field":"BusinessHoursThreshold","description":"Time-based threshold for elevated alerting on permission changes outside business hours"}],"live":true,"detection_strategies":["DET0299"],"techniques":["T1222"]},{"id":"AN0835","stix_id":"x-mitre-analytic--e268a6cb-2264-473e-9683-fb0f33ecd793","name":"Analytic 0835","description":"Behavioral sequence of unauthorized privilege escalation via permission modification: (1) chmod/chown/setfacl process execution with suspicious parameters, (2) Targeting of critical system files or unusual permission values, (3) Correlation with non-privileged user context or unusual timing patterns, (4) Follow-on file access indicating successful permission bypass","url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0835","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr)","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"auditd-syscall"},{"name":"auditd:PROCTITLE","channel":"proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-proctitle"}],"mutable_elements":[{"field":"SuspiciousPermissionValues","description":"Octal permission values that indicate potential malicious intent (default: 777, 755, 4755)"},{"field":"CriticalPathPatterns","description":"Linux filesystem paths requiring enhanced monitoring (/etc/, /usr/bin/, /home/)"},{"field":"AuthorizedAdminUsers","description":"User accounts permitted to perform system-level permission modifications"},{"field":"AnomalyThreshold","description":"Statistical threshold for detecting unusual permission modification frequency"}],"live":true,"detection_strategies":["DET0299"],"techniques":["T1222"]},{"id":"AN0836","stix_id":"x-mitre-analytic--e564e2b8-542b-4003-a8b7-df9d3396f5b9","name":"Analytic 0836","description":"macOS-specific permission modification behavioral chain: (1) chmod/chown/chflags process execution, (2) System Integrity Protection (SIP) bypass attempts, (3) Extended attribute (xattr) modifications, (4) Unified log correlation with file system events, (5) Subsequent access to previously restricted resources","url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0836","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process execution events for chmod, chown, chflags with unusual parameters or targets","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsevents","channel":"file system events indicating permission or attribute changes","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"fs-fsevents"}],"mutable_elements":[{"field":"SIPProtectedPaths","description":"macOS system paths protected by SIP that should never have permission modifications"},{"field":"SuspiciousFlagCombinations","description":"chflags parameter combinations indicating evasive behavior (uchg, schg, hidden)"},{"field":"XattrMonitoringScope","description":"Extended attributes to monitor for unauthorized modifications"},{"field":"UnifiedLogRetention","description":"Log retention period for correlating permission changes with subsequent access"}],"live":true,"detection_strategies":["DET0299"],"techniques":["T1222"]},{"id":"AN0837","stix_id":"x-mitre-analytic--13a1653f-3d4e-4a4f-9619-f8e8a97ec60d","name":"Analytic 0837","description":"ESXi hypervisor permission modification behavioral chain: (1) SSH access to ESXi host, (2) chmod/chown execution on VMFS datastore files or system configuration, (3) Modification of VM configuration files (.vmx) or virtual disk permissions, (4) Hostd service log correlation, (5) vCenter permission change events if centrally managed","url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0837","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"shell command execution for chmod, chown, or file permission modification on VMFS or system files","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"},{"name":"esxi:hostd","channel":"host daemon events related to file or VM permission changes","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"esxi-hostd"},{"name":"esxi:vpxd","channel":"permission change operations on datastores or VMs","data_component":"DC0066","data_component_name":"Active Directory Object Modification","log_source_slug":"esxi-vpxd"}],"mutable_elements":[{"field":"AuthorizedSSHUsers","description":"ESXi user accounts authorized for shell access and file system operations"},{"field":"CriticalVMFSPaths","description":"VMFS datastore paths requiring permission change monitoring"},{"field":"ShellAccessTimeWindow","description":"Time correlation window for linking SSH access with permission modifications"},{"field":"vCenterIntegrationScope","description":"Scope of vCenter audit event correlation with ESXi host activities"}],"live":true,"detection_strategies":["DET0299"],"techniques":["T1222"]}],"live":true,"version":"1.0","techniques":["T1222"]}],"sigma_rules":[{"id":"3bf1d859-3a7e-44cb-8809-a99e066d3478","title":"PowerShell Set-Acl On Windows Folder - PsScript","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-07-18","modified":null,"description":"Detects PowerShell scripts to set the ACL to a file in the Windows folder","references":["https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.defense-impairment","attack.t1222"],"path":"rules/windows/powershell/powershell_script/posh_ps_set_acl_susp_location.yml","techniques":["T1222"],"cves":[]},{"id":"cae80281-ef23-44c5-873b-fd48d2666f49","title":"PowerShell Script Change Permission Via Set-Acl - PsScript","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-07-18","modified":null,"description":"Detects PowerShell scripts set ACL to of a file or a folder","references":["https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.defense-impairment","attack.t1222"],"path":"rules/windows/powershell/powershell_script/posh_ps_set_acl.yml","techniques":["T1222"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2022-22960","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}