Detect Windows File and Directory Permissions Modification in Elastic Security

process where event.type == "start" and
process.name in~ ("icacls.exe", "cacls.exe", "takeown.exe", "attrib.exe", "powershell.exe", "pwsh.exe") and
(
  (
    process.name like~ "icacls.exe" and
    (
      process.command_line like~ "*everyone:f*" or
      process.command_line like~ "*everyone:full*" or
      process.command_line like~ "*/grant everyone*" or
      process.command_line like~ "*/inheritance:r*" or
      process.command_line like~ "*/inheritance:d*" or
      (
        process.command_line like~ "*/reset*" and
        (
          process.command_line like~ "*c:\\\\windows*" or
          process.command_line like~ "*c:\\\\system32*" or
          process.command_line like~ "*c:\\\\program files*" or
          process.command_line like~ "*\\\\backup*" or
          process.command_line like~ "*\\\\recovery*"
        )
      ) or
      (
        process.command_line like~ "*/grant*" and
        process.command_line like~ "* /t *" and
        process.command_line like~ "* /c *"
      )
    )
  ) or
  (
    process.name like~ "takeown.exe" and
    process.command_line like~ "* /f *" and
    (
      process.command_line like~ "*c:\\\\windows*" or
      process.command_line like~ "*c:\\\\system32*" or
      process.command_line like~ "*c:\\\\program*" or
      process.command_line like~ "*\\\\backup*" or
      process.command_line like~ "*\\\\recovery*" or
      process.command_line like~ "* /r*" or
      process.command_line like~ "* /a*"
    )
  ) or
  (
    process.name like~ "cacls.exe" and
    (
      process.command_line like~ "*everyone:f*" or
      process.command_line like~ "*/e /g*" or
      process.command_line like~ "*/g everyone*" or
      process.command_line like~ "*/p *"
    )
  ) or
  (
    process.name like~ "attrib.exe" and
    process.command_line like~ "*+h*" and
    (
      process.command_line like~ "*c:\\\\windows*" or
      process.command_line like~ "*c:\\\\system32*" or
      process.command_line like~ "*c:\\\\program files*" or
      process.command_line like~ "*c:\\\\programdata*"
    )
  ) or
  (
    process.name in~ ("powershell.exe", "pwsh.exe") and
    (
      process.command_line like~ "*set-acl*" or
      process.command_line like~ "*setaccessrule*" or
      process.command_line like~ "*addaccessrule*"
    ) and
    (
      process.command_line like~ "*everyone*" or
      process.command_line like~ "*fullcontrol*"
    )
  )
)