Cross-source coverage

T1222 / ATT&CK

File and Directory Permissions Modification

89 rules · 85 families across 9 sources.

From MITRE ATT&CK 19.2

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, Unix Shell Configuration Modification, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.

Adversaries may also change permissions of symbolic links. For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.

Platforms
ESXi · Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:PowerShellauditd:SYSCALLauditd:PROCTITLEmacos:unifiedlogfs:fseventsesxi:shellesxi:hostdesxi:vpxd

How MITRE says to detect it DET0299

Multi-Platform File and Directory Permissions Modification Detection Strategy

Windows Analytic 0834

Sequential behavioral chain of privilege escalation through permission modification: (1) Process creation of permission-modifying utilities (icacls, takeown, attrib, cacls), (2) Correlation with unusual user context or timing, (3) DACL modification events targeting sensitive files/directories, (4) Subsequent file access or modification attempts indicating successful privilege bypass

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106

Linux Analytic 0835

Behavioral sequence of unauthorized privilege escalation via permission modification: (1) chmod/chown/setfacl process execution with suspicious parameters, (2) Targeting of critical system files or unusual permission values, (3) Correlation with non-privileged user context or unusual timing patterns, (4) Follow-on file access indicating successful permission bypass

  • auditd:SYSCALL syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr)
  • auditd:PROCTITLE proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters

macOS Analytic 0836

macOS-specific permission modification behavioral chain: (1) chmod/chown/chflags process execution, (2) System Integrity Protection (SIP) bypass attempts, (3) Extended attribute (xattr) modifications, (4) Unified log correlation with file system events, (5) Subsequent access to previously restricted resources

  • macos:unifiedlog process execution events for chmod, chown, chflags with unusual parameters or targets
  • fs:fsevents file system events indicating permission or attribute changes

ESXi Analytic 0837

ESXi hypervisor permission modification behavioral chain: (1) SSH access to ESXi host, (2) chmod/chown execution on VMFS datastore files or system configuration, (3) Modification of VM configuration files (.vmx) or virtual disk permissions, (4) Hostd service log correlation, (5) vCenter permission change events if centrally managed

  • esxi:shell shell command execution for chmod, chown, or file permission modification on VMFS or system files
  • esxi:hostd host daemon events related to file or VM permission changes
  • esxi:vpxd permission change operations on datastores or VMs

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 89 above — a rule tagged a sub-technique covers this technique too.

splunk/security_content

28 rules
Detection Severity Format
Excessive Usage Of Cacls App Undefined SPL
Hiding Files And Directories With Attrib exe Undefined SPL
Icacls Deny Command Undefined SPL
ICACLS Grant Command Undefined SPL
Linux Auditd Change File Owner To Root Undefined SPL
Linux Auditd File Permission Modification Via Chmod Undefined SPL
Linux Auditd File Permissions Modification Via Chattr Undefined SPL
Linux Change File Owner To Root Undefined SPL
Modify ACL permission To Files Or Folder Undefined SPL
Permission Modification using Takeown App Undefined SPL

+ 18 more from splunk/security_content → showing the 10 highest-severity

socfortress/Wazuh-Rules

19 rules · 16 families
Detection Severity Format
AD Object WriteDAC Access Critical Wazuh XML
chattr used to remove immutable attribute - T1222.002 High Wazuh XML
chmod used recursively on directory - T1222.002 High Wazuh XML
chown used recursively - T1222.002 High Wazuh XML
chown used to change file/folder ownership - T1222.002 High Wazuh XML
Detects file and folder permission changes. 2 variants High Wazuh XML
Detects file and folder permission changes. 2 variants High Wazuh XML
Detects removing immutable file attribute. 2 variants High Wazuh XML
Detects removing immutable file attribute. 2 variants High Wazuh XML
Sysmon - Event 1: Process creation · Attrib usage to hide or unprotect files (T1222.001) High Wazuh XML

+ 9 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

elastic/detection-rules

15 rules
Detection Severity Format
File Permission Modification in Writable Directory High Elastic TOML
Azure Blob Storage Permissions Modified Medium Elastic TOML
Executable Bit Set for Potential Persistence Script Medium Elastic TOML
File Creation in World-Writable Directory by Unusual Process Medium Elastic TOML
File made Immutable by Chattr Medium Elastic TOML
GCP Storage Bucket Permissions Modification Medium Elastic TOML
Potential Unauthorized Access via Wildcard Injection Detected Medium Elastic TOML
Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities Medium Elastic TOML
System File Ownership Change Medium Elastic TOML
Access Control List Modification via setfacl Low Elastic TOML

+ 5 more from elastic/detection-rules → showing the 10 highest-severity

SigmaHQ/sigma

11 rules
Detection Severity Format
AD Object WriteDAC Access Critical Sigma
WannaCry Ransomware Activity Critical Sigma
PowerShell Set-Acl On Windows Folder - PsScript High Sigma
Chmod Targeting Sensitive Directories Medium Sigma
File or Folder Permissions Modifications Medium Sigma
Potentially Suspicious NTFS Symlink Behavior Modification Medium Sigma
Remove Immutable File Attribute Medium Sigma
Remove Immutable File Attribute - Auditd Medium Sigma
Suspicious Recursive Takeown Medium Sigma
File or Folder Permissions Change Low Sigma

+ 1 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/protections-artifacts

5 rules
Detection Severity Format
Chattr Execution from Unusual Parent Undefined Elastic TOML
Chattr Execution with Unusual Target File Undefined Elastic TOML
File Made Executable via Package Install Script Undefined Elastic TOML
Shared Memory File Turned Executable by Suspicious Parent Undefined Elastic TOML
System Boot Files Permission Change Undefined Elastic TOML

Wazuh Core Ruleset

4 rules
Detection Severity Format
GCP storage bucket configuration modified. Low Wazuh XML
GCP storage bucket permissions modified. Low Wazuh XML
has been denied permission to at . · match (?i)update access record.+denied Low Wazuh XML
has been granted permission to at . · match (?i)update access record.+allowed Low Wazuh XML

panther-labs/panther-analysis

4 rules
Detection Severity Format
Kubernetes System Role Modified or Deleted Critical Panther Python
Slack Private Channel Made Public High Panther Python
Azure Storage Blob Container Permissions Modified Medium Panther Python
Kubernetes Role With Write Permissions Created Low Panther Python

falcosecurity/rules

2 rules
Detection Severity Format
Mkdir binary dirs High Falco YAML
Modify binary dirs High Falco YAML

chainguard-dev/osquery-defense-kit

1 rule
Detection Severity Format
Find processes running that are tied to binaries with unsual permissions. Namely, 0777. Undefined osquery SQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.