File and Directory Permissions Modification
Adversaries may modify file or directory permissions and ACLs to evade access controls and enable access to protected files. On Windows, tools like icacls, cacls, takeown, attrib, and PowerShell's Set-Acl cmdlet are abused to grant unauthorized access, remove inheritance, or take ownership of sensitive files and directories. On Linux and macOS, chmod, chown, chattr, and setfacl are used to widen permissions on credential files, binaries, or configuration data. Permission modifications commonly precede or accompany other techniques such as persistence via accessibility features, boot scripts, or hijack execution flow.
What is T1222 File and Directory Permissions Modification?
File and Directory Permissions Modification (T1222) maps to the Defense Evasion tactic — the adversary is trying to avoid being detected in MITRE ATT&CK.
This page provides production-ready detection logic for File and Directory Permissions Modification, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Canonical reference
- https://attack.mitre.org/techniques/T1222/
let PermModTools = dynamic(["icacls.exe", "cacls.exe", "xcacls.exe", "takeown.exe", "attrib.exe", "SetACL.exe"]);
let HighValuePaths = dynamic(["\\system32\\", "\\syswow64\\", "\\windows\\", "\\program files\\", "\\programdata\\", "\\users\\", "\\sam", "\\security", "\\ntds", "\\lsass", "\\hosts"]);
let SuspiciousFlags = dynamic(["/grant", "/deny", "/reset", "/setowner", "/inheritance:r", "/inheritance:d", "Everyone", "BUILTIN\\Everyone", ":(OI)(CI)F", ":(F)", "/T /C /Q"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (PermModTools)
or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Set-Acl", "SetAccessControl", "InheritanceFlags", "PropagationFlags", "FileSystemAccessRule", "RegistryAccessRule", "AddAccessRule", "SetOwner"))
or (FileName =~ "cmd.exe" and ProcessCommandLine has_any ("icacls", "cacls", "takeown", "SetACL"))
| extend IsPermTool = FileName in~ (PermModTools)
| extend IsHighValuePath = ProcessCommandLine has_any (HighValuePaths)
| extend HasSuspiciousFlag = ProcessCommandLine has_any (SuspiciousFlags)
| extend GrantsEveryone = ProcessCommandLine has_any ("Everyone", "BUILTIN\\Everyone", "*S-1-1-0*")
| extend RemovesInheritance = ProcessCommandLine has_any ("/inheritance:r", "/inheritance:d")
| extend TakeOwnership = FileName =~ "takeown.exe" or ProcessCommandLine has "/setowner"
| extend GrantsFullControl = ProcessCommandLine has_any (":(F)", ":(OI)(CI)F", "/grant Everyone:F", "/grant *:F")
| extend IsPowerShellACL = FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Set-Acl", "SetAccessControl", "AddAccessRule")
| extend SuspicionScore = toint(IsHighValuePath) + toint(HasSuspiciousFlag) + toint(GrantsEveryone) + toint(RemovesInheritance) + toint(TakeOwnership) + toint(GrantsFullControl)
| where SuspicionScore > 0 or IsPermTool or IsPowerShellACL
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
IsHighValuePath, HasSuspiciousFlag, GrantsEveryone, RemovesInheritance,
TakeOwnership, GrantsFullControl, IsPowerShellACL, SuspicionScore
| sort by Timestamp descDetects file and directory permission modification on Windows using Microsoft Defender for Endpoint DeviceProcessEvents. Monitors for native permission tools (icacls, cacls, xcacls, takeown, attrib, SetACL) and PowerShell ACL cmdlets (Set-Acl, SetAccessControl, AddAccessRule). Assigns a suspicion score based on high-value path targets, Everyone grants, inheritance removal, full control grants, and ownership changes. Covers both direct tool invocation and cmd.exe-wrapped execution.
Data Sources
Required Tables
False Positives
- Software installation routines that reset permissions on application directories during setup or update (SCCM, Intune, installers)
- IT administrators using icacls or takeown to recover access to orphaned files after account migrations or domain rejoins
- Backup agents (Veeam, Acronis, Windows Server Backup) that modify file ACLs to enable backup of protected files
- Endpoint security tools resetting permissions on quarantined files or their own installation directories
- CI/CD pipeline agents (GitHub Actions, Jenkins, Azure DevOps agents) adjusting permissions on build artifact directories
Sigma rule & cross-platform mapping
The detection logic for File and Directory Permissions Modification (T1222) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for T1222
References (16)
- https://attack.mitre.org/techniques/T1222/
- https://attack.mitre.org/techniques/T1222/001/
- https://attack.mitre.org/techniques/T1222/002/
- https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100
- https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110
- https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/
- https://go.kaspersky.com/rs/802-IJN-240/images/TR_BlackCat_Report.pdf
- https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-alphv-rust-ransomware
- https://www.crowdstrike.com/blog/falcon-overwatch-contributes-to-blackcat-protection/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.002/T1222.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1icacls Grant Everyone Full Control on Test File
Expected signal: Sysmon Event ID 1: Process Create with Image=icacls.exe, CommandLine containing '/grant Everyone:(F)'. Security Event ID 4670 (if Object Access auditing enabled) showing the permission change on the temp file. Security Event ID 4688 (if process auditing enabled) with command line.
- Test 2takeown and icacls Ownership Transfer Sequence
Expected signal: Two Sysmon Event ID 1 entries: first for takeown.exe with /F flag, second for icacls.exe with /grant flag. Security Event ID 4670 for the ACL change. Security Event ID 4672 (Special Privileges Assigned) if run with elevated rights. The sequential execution of takeown then icacls within a short time window is a high-confidence indicator.
- Test 3PowerShell Set-Acl to Widen Directory Permissions
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Set-Acl', 'FileSystemAccessRule', 'Everyone', 'FullControl', and 'AddAccessRule'. PowerShell ScriptBlock Log Event ID 4104 capturing the full ACL manipulation code. Security Event ID 4670 on the target directory.
- Test 4icacls Remove ACL Inheritance on Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=icacls.exe and CommandLine containing '/inheritance:r'. Security Event ID 4670 showing the removal of inherited ACEs (Access Control Entries) from the directory. The OldSd field in Event 4670 will show inherited entries, NewSd will show none.
- Test 5attrib to Remove Hidden and System Attributes from Malware Artifacts
Expected signal: Two Sysmon Event ID 1 entries for attrib.exe: first with +H +S flags (adding attributes), second with -H -S -R flags (removing attributes). Security Event ID 4663 if file auditing is enabled. The attribute removal (-H -S -R) invocation is the malicious indicator — the first is included to simulate the full adversary workflow.
Response Playbook
Triage
- Identify the target path — is it a system binary (C:\Windows\System32\), credential store (SAM, NTDS.dit, /etc/shadow), configuration file (hosts, sudoers), or a user-controlled directory? System and credential paths are highest priority.
- Examine the specific permission change — does it grant Everyone or Authenticated Users full control (:(F))? Does it remove ACL inheritance (/inheritance:r)? Does it add a deny entry to block security tools? Any of these indicate intentional access control subversion.
- Check if takeown.exe was used before icacls — this sequence (ownership then permission grant) is a strong indicator of deliberate access control bypass, as normal admin tasks rarely require both steps.
- Review the initiating process — was this launched by a script host (wscript.exe, cscript.exe, mshta.exe), an Office application, or a service process that would not normally modify permissions? Unusual parents are high-confidence malicious indicators.
- Check the user account context — is this a standard user account that shouldn't have permission to modify ACLs on the targeted path? SYSTEM or domain admin performing widespread permission changes may indicate ransomware pre-staging.
- Look for temporal correlation — did this permission modification precede or follow file writes, process injection events, or lateral movement? Ransomware families like BlackCat/ALPHV and Qilin modify ACLs before encryption to ensure file accessibility.
- Check for symbolic link manipulation alongside permission changes — adversaries like Qilin redirect file paths via symlinks combined with permission resets to access remote or protected objects.
Containment
- If system binary permissions were modified: immediately isolate the endpoint from the network using EDR network isolation or VLAN reassignment to prevent potential follow-on exploitation.
- If credential files (SAM, NTDS.dit, /etc/shadow, /etc/passwd) were targeted: assume credential compromise — initiate password resets for all accounts on the affected system and treat extracted hashes as compromised.
- Restore original permissions as soon as possible using known-good ACL backups or reference baselines. For SAM/SECURITY: icacls C:\Windows\System32\config\SAM /reset /T. For System32: icacls C:\Windows\System32 /reset /T.
- If ransomware pre-staging is suspected (bulk permission changes across many files): immediately isolate the host, identify the malicious process, terminate it, and take a memory snapshot before any remediation.
- Block the responsible executable or script by hash at the EDR level to prevent re-execution on the same or other hosts.
- If domain-level accounts were used: review Active Directory for any GPO changes or delegations that may have been established as a persistence mechanism alongside the permission modification.
Evidence Collection
- Security Event ID 4670 (Permissions on an object were changed) — captures before/after ACL state, the object name, process, and account that made the change. Requires Object Access auditing to be enabled.
- Security Event ID 4663 (An attempt was made to access an object) — correlated with 4670, shows what access was requested on the now-modified object.
- Security Event ID 4656 (A handle to an object was requested) — shows the access mask requested when a process opened the target file/directory.
- Sysmon Event ID 1 (Process Create) — captures the full command line of icacls, takeown, cacls, and PowerShell ACL cmdlets.
- Sysmon Event ID 11 (File Create) — if the adversary replaced a file after widening permissions, this captures the write.
- Sysmon Event ID 12/13/14 (Registry Create/Set/Delete) — if ACL changes targeted registry keys rather than file system objects.
- File System: Collect ACL snapshots of the modified directory using: icacls <path> /save acl_snapshot.txt — compare to a known-good baseline.
- Windows Security Log — filter EventID 4670 with ObjectName matching the targeted path. Export as EVTX for forensic preservation.
- VSS / Volume Shadow Copy — if available, compare file permissions against shadow copies to establish a timeline of permission changes.
- Linux auditd logs (if applicable): ausearch -k file_perm_change or audit.log entries for syscalls chmod, fchmod, chown, fchown, setxattr.
Escalation Criteria
- ! Permissions modified on SAM, NTDS.dit, SECURITY hive, /etc/shadow, or /etc/passwd — immediate credential compromise response required.
- ! System binaries in C:\Windows\System32\ or /usr/bin/ targeted — indicates preparation for binary replacement or hijack execution flow attack.
- ! Bulk permission modification across many files or directories in rapid succession — consistent with ransomware pre-encryption staging (BlackCat, Qilin, Medusa patterns).
- ! Permission change on a security tool's executable or directory (EDR agent, AV binary, SIEM agent) — indicates active defense evasion and attacker presence.
- ! takeown.exe or /setowner used on files owned by SYSTEM or TrustedInstaller — unauthorized ownership transfer suggests root-level compromise or kernel exploitation.
- ! Modification performed by a service account or non-interactive account that has no legitimate business need to modify ACLs.
- ! Permission change followed immediately by file execution from the modified path — confirms weaponization of the access control bypass.
Investigation Guide
Forensic Artifacts
- >
Windows Security Event Log: Event ID 4670 (Permissions on object changed) — includes SubjectUserName, ObjectName, OldSd (old security descriptor), NewSd (new security descriptor). Requires Audit Object Access policy. - >
Windows Security Event Log: Event ID 4663 (Object access attempt) correlated to the modified object post-permission-change. - >
Prefetch: C:\Windows\Prefetch\ICACLS.EXE-*.pf, TAKEOWN.EXE-*.pf, CACLS.EXE-*.pf — execution timestamps and accessed file references. - >
File System: ACL state on modified files — retrievable via: Get-Acl <path> | Format-List or icacls <path>. Compare to SDDL baseline. - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services — service binary paths that may have been targeted for permission widening to enable DLL hijacking. - >
USNJournal (C:\$Extend\$UsnJrnl:$J) — records file attribute and permission change timestamps at the NTFS level, even if Security logs were cleared. - >
Linux auditd: /var/log/audit/audit.log — syscall records for chmod(2), fchmod(2), chown(2), fchown(2), lchown(2), setxattr(2) with process context. - >
Linux: /var/log/auth.log or /var/log/secure — sudo usage for permission commands (sudo chmod, sudo chown) with timestamp and invoking user. - >
macOS: Unified System Log — entries from kernel for permission changes; use: log show --predicate 'process == "chmod"' --info. - >
VSS Shadow Copies — compare ACLs of targeted files at different points in time using: vssadmin list shadows and mounting prior snapshots.
Tuning Guidance
Begin by baselining which accounts and parent processes legitimately invoke icacls and takeown in your environment. The highest-volume sources are typically: (1) software installers called from msiexec — exclude by parent process and correlate with change management tickets; (2) backup agents with known service account names; (3) IT automation scripts from known management hosts. Build allowlists keyed on the combination of AccountName + InitiatingProcessFileName + target path prefix — never allowlist the tool name alone. Elevate severity to high whenever the target path includes credential stores (SAM, NTDS, /etc/shadow), security tool directories, or system binaries. The bulk execution hunting query (5+ hits in 15 minutes) should be treated as critical with no tuning suppression — ransomware staging windows are short and suppressing this pattern risks missing an active attack. For PowerShell Set-Acl detections, combine with DeviceNetworkEvents to identify whether a download or C2 connection preceded the ACL change, which transforms a medium-confidence event into a high-confidence incident. Enable Security Event ID 4670 audit (requires Object Access auditing policy) to capture the actual before/after security descriptor strings, which provide authoritative evidence of what changed and support rollback.
Hunting Queries
Hunt for permission modification tools invoked by script hosts or LOLBins (wscript, cscript, mshta, rundll32, regsvr32). Legitimate software installations use msiexec or dedicated installers — scripting engines and proxy executables spawning icacls/takeown is a strong indicator of malicious automation or macro-delivered malware.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("icacls.exe", "cacls.exe", "takeown.exe", "attrib.exe")
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe", "cmd.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe", "svchost.exe")
| where InitiatingProcessCommandLine !has "MsiExec" and InitiatingProcessCommandLine !has "TiWorker"
| summarize Count=count(), TargetPaths=make_set(ProcessCommandLine), Devices=dcount(DeviceName) by InitiatingProcessFileName, AccountName, bin(Timestamp, 1h)
| where Count > 2
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\icacls.exe" OR Image="*\\cacls.exe" OR Image="*\\takeown.exe" OR Image="*\\attrib.exe")
(ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\mshta.exe" OR ParentImage="*\\rundll32.exe" OR ParentImage="*\\regsvr32.exe")
| stats count as Count, values(CommandLine) as TargetPaths, dc(host) as Devices by ParentImage, User, span(_time, 1h)
| where Count > 1
| sort - CountHunt specifically for permission tools targeting high-value Windows directories: System32, SysWOW64, Windows Defender installation path, Security Account Manager config, and event log directories. These locations are targeted by malware seeking to disable security tools, dump credentials, or tamper with audit logs.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "icacls.exe" or FileName =~ "cacls.exe" or FileName =~ "takeown.exe"
| where ProcessCommandLine has_any (
"C:\\Windows\\System32\\",
"C:\\Windows\\SysWOW64\\",
"C:\\Program Files\\",
"C:\\ProgramData\\Microsoft\\Windows Defender",
"C:\\Windows\\System32\\config\\",
"C:\\Windows\\System32\\winevt"
)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\icacls.exe" OR Image="*\\cacls.exe" OR Image="*\\takeown.exe")
(CommandLine="*\\Windows\\System32\\*" OR CommandLine="*\\Windows\\SysWOW64\\*" OR CommandLine="*\\Program Files\\*" OR CommandLine="*\\Windows Defender*" OR CommandLine="*\\System32\\config\\*" OR CommandLine="*\\winevt*")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _timeHunt for bulk permission modification activity — 5 or more icacls/takeown executions within a 15-minute window on a single host. This pattern is characteristic of ransomware pre-encryption staging (BlackCat/ALPHV, Qilin, Medusa) that systematically removes ACL restrictions from target directories before beginning file encryption or destruction.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("icacls.exe", "takeown.exe", "cacls.exe")
| summarize
CmdCount = count(),
UniquePaths = dcount(ProcessCommandLine),
Commands = make_set(ProcessCommandLine, 20),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by DeviceName, AccountName, bin(Timestamp, 15m)
| where CmdCount >= 5
| extend Duration = datetime_diff('minute', LastSeen, FirstSeen)
| sort by CmdCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\icacls.exe" OR Image="*\\takeown.exe" OR Image="*\\cacls.exe")
| bin _time span=15m
| stats count as CmdCount, dc(CommandLine) as UniquePaths, values(CommandLine) as Commands, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, User, _time
| where CmdCount >= 5
| eval DurationSecs=LastSeen-FirstSeen
| sort - CmdCountAtomic Red Team Tests
Creates a test file and uses icacls to grant the Everyone group full control, removing restrictions. This simulates the pattern used by ransomware and post-exploitation tooling to ensure access to files before modification, encryption, or exfiltration. Uses a temp file to avoid impacting production paths.
Command
echo test content > %TEMP%\df00tech-acl-test.txt && icacls %TEMP%\df00tech-acl-test.txt /grant Everyone:(F) /T /C /QCleanup
icacls %TEMP%\df00tech-acl-test.txt /reset && del %TEMP%\df00tech-acl-test.txtExpected Telemetry
Sysmon Event ID 1: Process Create with Image=icacls.exe, CommandLine containing '/grant Everyone:(F)'. Security Event ID 4670 (if Object Access auditing enabled) showing the permission change on the temp file. Security Event ID 4688 (if process auditing enabled) with command line.
Expected Detection
Alert fires on icacls.exe execution with GrantsEveryone=true and GrantsFullControl=true. KQL: SuspicionScore >= 2. SPL: SuspicionScore >= 2.
Simulates the two-step permission takeover sequence: first use takeown to claim ownership of a file, then use icacls to grant the current user full control. This pattern is used by attackers to override ACLs on files they don't own, including system files and credential stores. Test uses a temp file.
Command
echo test > %TEMP%\df00tech-takeown-test.txt && takeown /F %TEMP%\df00tech-takeown-test.txt && icacls %TEMP%\df00tech-takeown-test.txt /grant %USERNAME%:(F)Cleanup
del %TEMP%\df00tech-takeown-test.txtExpected Telemetry
Two Sysmon Event ID 1 entries: first for takeown.exe with /F flag, second for icacls.exe with /grant flag. Security Event ID 4670 for the ACL change. Security Event ID 4672 (Special Privileges Assigned) if run with elevated rights. The sequential execution of takeown then icacls within a short time window is a high-confidence indicator.
Expected Detection
Alert fires twice — once for takeown.exe (TakeOwnership=true) and once for icacls.exe (GrantsFullControl=true). KQL: TakeOwnership=true. SPL: TakeOwnership=1.
Uses PowerShell's Set-Acl cmdlet to programmatically grant the current user full control over a test directory. This is a stealthier approach than invoking icacls directly and is used by sophisticated tooling and post-exploitation frameworks to modify permissions from within a PowerShell session.
Command
New-Item -ItemType Directory -Path $env:TEMP\df00tech-setacl-test -Force; $acl = Get-Acl $env:TEMP\df00tech-setacl-test; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Everyone','FullControl','ContainerInherit,ObjectInherit','None','Allow'); $acl.AddAccessRule($rule); Set-Acl -Path $env:TEMP\df00tech-setacl-test -AclObject $aclCleanup
Remove-Item -Recurse -Force $env:TEMP\df00tech-setacl-test -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Set-Acl', 'FileSystemAccessRule', 'Everyone', 'FullControl', and 'AddAccessRule'. PowerShell ScriptBlock Log Event ID 4104 capturing the full ACL manipulation code. Security Event ID 4670 on the target directory.
Expected Detection
Alert fires on PowerShell process with IsPowerShellACL=true. KQL: IsPowerShellACL=true, command line matches Set-Acl and FileSystemAccessRule. SPL: IsPowerShellACL=1.
Uses icacls to remove inherited ACL entries from a directory and converts inherited permissions to explicit ones, then strips them. The /inheritance:r flag removes the inheritance link, and /inheritance:d disables inheritance while preserving existing permissions. This is used by adversaries to prevent parent directory permission changes from cascading down to a malicious payload directory.
Command
mkdir %TEMP%\df00tech-inherit-test && icacls %TEMP%\df00tech-inherit-test /inheritance:rCleanup
icacls %TEMP%\df00tech-inherit-test /inheritance:e && rmdir /S /Q %TEMP%\df00tech-inherit-testExpected Telemetry
Sysmon Event ID 1: Process Create with Image=icacls.exe and CommandLine containing '/inheritance:r'. Security Event ID 4670 showing the removal of inherited ACEs (Access Control Entries) from the directory. The OldSd field in Event 4670 will show inherited entries, NewSd will show none.
Expected Detection
Alert fires on icacls.exe with RemovesInheritance=true. KQL: RemovesInheritance=true, SuspicionScore >= 1. SPL: RemovesInheritance=1.
Uses attrib.exe to remove Hidden and System file attributes from a test file. Adversaries use this technique to restore visibility of previously hidden malware components for re-execution, or to clear attributes on files they want to modify. Also used to remove the ReadOnly attribute from protected configuration files prior to tampering.
Command
echo hidden content > %TEMP%\df00tech-attrib-test.txt && attrib +H +S %TEMP%\df00tech-attrib-test.txt && attrib -H -S -R %TEMP%\df00tech-attrib-test.txtCleanup
del %TEMP%\df00tech-attrib-test.txtExpected Telemetry
Two Sysmon Event ID 1 entries for attrib.exe: first with +H +S flags (adding attributes), second with -H -S -R flags (removing attributes). Security Event ID 4663 if file auditing is enabled. The attribute removal (-H -S -R) invocation is the malicious indicator — the first is included to simulate the full adversary workflow.
Expected Detection
Alert fires on attrib.exe execution. The -H -S -R pattern indicates attribute removal. KQL: FileName=~'attrib.exe', IsPermTool=true. SPL: IsTool=1.