Detect File and Directory Permissions Modification in Sumo Logic CSE
Adversaries may modify file or directory permissions and ACLs to evade access controls and enable access to protected files. On Windows, tools like icacls, cacls, takeown, attrib, and PowerShell's Set-Acl cmdlet are abused to grant unauthorized access, remove inheritance, or take ownership of sensitive files and directories. On Linux and macOS, chmod, chown, chattr, and setfacl are used to widen permissions on credential files, binaries, or configuration data. Permission modifications commonly precede or accompany other techniques such as persistence via accessibility features, boot scripts, or hijack execution flow.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Canonical reference
- https://attack.mitre.org/techniques/T1222/
Sumo Detection Query
_sourceCategory=*windows* OR _sourceCategory=*sysmon*
| where EventCode = 1
| where Image matches "*icacls.exe" OR Image matches "*cacls.exe" OR Image matches "*xcacls.exe"
OR Image matches "*takeown.exe" OR Image matches "*attrib.exe" OR Image matches "*SetACL.exe"
OR (Image matches "*powershell.exe"
AND (CommandLine matches "*Set-Acl*" OR CommandLine matches "*SetAccessControl*"
OR CommandLine matches "*AddAccessRule*" OR CommandLine matches "*InheritanceFlags*"
OR CommandLine matches "*FileSystemAccessRule*" OR CommandLine matches "*SetOwner*"))
OR (Image matches "*cmd.exe"
AND (CommandLine matches "*icacls*" OR CommandLine matches "*cacls*"
OR CommandLine matches "*takeown*" OR CommandLine matches "*SetACL*"))
| eval IsTool = if(Image matches "*icacls.exe*" OR Image matches "*cacls.exe*" OR Image matches "*xcacls.exe*" OR Image matches "*takeown.exe*" OR Image matches "*attrib.exe*" OR Image matches "*SetACL.exe*", 1, 0)
| eval GrantsEveryone = if(toLowerCase(CommandLine) matches "*everyone*" OR CommandLine matches "*S-1-1-0*", 1, 0)
| eval RemovesInheritance = if(CommandLine matches "*/inheritance:r*" OR CommandLine matches "*/inheritance:d*", 1, 0)
| eval TakeOwnership = if(Image matches "*takeown.exe*" OR toLowerCase(CommandLine) matches "*/setowner*", 1, 0)
| eval GrantsFullControl = if(CommandLine matches "*:(F)*" OR CommandLine matches "*:(OI)(CI)F*" OR CommandLine matches "*/grant*:F*", 1, 0)
| eval HighValuePath = if(toLowerCase(CommandLine) matches "*\\system32\\*" OR toLowerCase(CommandLine) matches "*\\syswow64\\*" OR toLowerCase(CommandLine) matches "*\\windows\\*" OR toLowerCase(CommandLine) matches "*\\ntds*" OR toLowerCase(CommandLine) matches "*\\lsass*" OR toLowerCase(CommandLine) matches "*\\sam*" OR toLowerCase(CommandLine) matches "*\\hosts*" OR toLowerCase(CommandLine) matches "*\\programdata\\*", 1, 0)
| eval IsPowerShellACL = if(Image matches "*powershell.exe*" AND (CommandLine matches "*Set-Acl*" OR CommandLine matches "*SetAccessControl*" OR CommandLine matches "*AddAccessRule*"), 1, 0)
| eval SuspicionScore = IsTool + GrantsEveryone + RemovesInheritance + TakeOwnership + GrantsFullControl + HighValuePath
| where SuspicionScore > 0 OR IsPowerShellACL = 1
| fields _time, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, GrantsEveryone, RemovesInheritance, TakeOwnership, GrantsFullControl, HighValuePath, IsPowerShellACL, SuspicionScore
| sort by _time descDetects T1222 File and Directory Permissions Modification in Sumo Logic against Windows Sysmon EventCode 1 (Process Create) logs. Computes a SuspicionScore from six behavioral signals — IsTool, GrantsEveryone, RemovesInheritance, TakeOwnership, GrantsFullControl, and HighValuePath — mirroring the scoring logic in the KQL and SPL detections. Alerts fire when SuspicionScore > 0 or a PowerShell ACL cmdlet is identified.
Data Sources
Required Tables
False Positives & Tuning
- Help desk staff using takeown or icacls to regain access to user-owned files during account migration, profile corruption repair, or password reset procedures on managed endpoints
- Security tools and EDR agents that legitimately modify ACLs on their own installation directories at install time or during self-protection routines
- CI/CD pipeline agents (Jenkins, GitHub Actions self-hosted runner, TeamCity) that reset folder permissions on build artifact or workspace directories between pipeline runs
Other platforms for T1222
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 icacls Grant Everyone Full Control on Test File
Expected signal: Sysmon Event ID 1: Process Create with Image=icacls.exe, CommandLine containing '/grant Everyone:(F)'. Security Event ID 4670 (if Object Access auditing enabled) showing the permission change on the temp file. Security Event ID 4688 (if process auditing enabled) with command line.
- Test 2 takeown and icacls Ownership Transfer Sequence
Expected signal: Two Sysmon Event ID 1 entries: first for takeown.exe with /F flag, second for icacls.exe with /grant flag. Security Event ID 4670 for the ACL change. Security Event ID 4672 (Special Privileges Assigned) if run with elevated rights. The sequential execution of takeown then icacls within a short time window is a high-confidence indicator.
- Test 3 PowerShell Set-Acl to Widen Directory Permissions
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Set-Acl', 'FileSystemAccessRule', 'Everyone', 'FullControl', and 'AddAccessRule'. PowerShell ScriptBlock Log Event ID 4104 capturing the full ACL manipulation code. Security Event ID 4670 on the target directory.
- Test 4 icacls Remove ACL Inheritance on Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=icacls.exe and CommandLine containing '/inheritance:r'. Security Event ID 4670 showing the removal of inherited ACEs (Access Control Entries) from the directory. The OldSd field in Event 4670 will show inherited entries, NewSd will show none.
- Test 5 attrib to Remove Hidden and System Attributes from Malware Artifacts
Expected signal: Two Sysmon Event ID 1 entries for attrib.exe: first with +H +S flags (adding attributes), second with -H -S -R flags (removing attributes). Security Event ID 4663 if file auditing is enabled. The attribute removal (-H -S -R) invocation is the malicious indicator — the first is included to simulate the full adversary workflow.
References (16)
- https://attack.mitre.org/techniques/T1222/
- https://attack.mitre.org/techniques/T1222/001/
- https://attack.mitre.org/techniques/T1222/002/
- https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100
- https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110
- https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/
- https://go.kaspersky.com/rs/802-IJN-240/images/TR_BlackCat_Report.pdf
- https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-alphv-rust-ransomware
- https://www.crowdstrike.com/blog/falcon-overwatch-contributes-to-blackcat-protection/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/icacls
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.001/T1222.001.md
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1222.002/T1222.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Response Playbook
Triage
- Identify the target path — is it a system binary (C:\Windows\System32\), credential store (SAM, NTDS.dit, /etc/shadow), configuration file (hosts, sudoers), or a user-controlled directory? System and credential paths are highest priority.
- Examine the specific permission change — does it grant Everyone or Authenticated Users full control (:(F))? Does it remove ACL inheritance (/inheritance:r)? Does it add a deny entry to block security tools? Any of these indicate intentional access control subversion.
- Check if takeown.exe was used before icacls — this sequence (ownership then permission grant) is a strong indicator of deliberate access control bypass, as normal admin tasks rarely require both steps.
- Review the initiating process — was this launched by a script host (wscript.exe, cscript.exe, mshta.exe), an Office application, or a service process that would not normally modify permissions? Unusual parents are high-confidence malicious indicators.
- Check the user account context — is this a standard user account that shouldn't have permission to modify ACLs on the targeted path? SYSTEM or domain admin performing widespread permission changes may indicate ransomware pre-staging.
- Look for temporal correlation — did this permission modification precede or follow file writes, process injection events, or lateral movement? Ransomware families like BlackCat/ALPHV and Qilin modify ACLs before encryption to ensure file accessibility.
- Check for symbolic link manipulation alongside permission changes — adversaries like Qilin redirect file paths via symlinks combined with permission resets to access remote or protected objects.
Containment
- If system binary permissions were modified: immediately isolate the endpoint from the network using EDR network isolation or VLAN reassignment to prevent potential follow-on exploitation.
- If credential files (SAM, NTDS.dit, /etc/shadow, /etc/passwd) were targeted: assume credential compromise — initiate password resets for all accounts on the affected system and treat extracted hashes as compromised.
- Restore original permissions as soon as possible using known-good ACL backups or reference baselines. For SAM/SECURITY: icacls C:\Windows\System32\config\SAM /reset /T. For System32: icacls C:\Windows\System32 /reset /T.
- If ransomware pre-staging is suspected (bulk permission changes across many files): immediately isolate the host, identify the malicious process, terminate it, and take a memory snapshot before any remediation.
- Block the responsible executable or script by hash at the EDR level to prevent re-execution on the same or other hosts.
- If domain-level accounts were used: review Active Directory for any GPO changes or delegations that may have been established as a persistence mechanism alongside the permission modification.
Evidence Collection
- Security Event ID 4670 (Permissions on an object were changed) — captures before/after ACL state, the object name, process, and account that made the change. Requires Object Access auditing to be enabled.
- Security Event ID 4663 (An attempt was made to access an object) — correlated with 4670, shows what access was requested on the now-modified object.
- Security Event ID 4656 (A handle to an object was requested) — shows the access mask requested when a process opened the target file/directory.
- Sysmon Event ID 1 (Process Create) — captures the full command line of icacls, takeown, cacls, and PowerShell ACL cmdlets.
- Sysmon Event ID 11 (File Create) — if the adversary replaced a file after widening permissions, this captures the write.
- Sysmon Event ID 12/13/14 (Registry Create/Set/Delete) — if ACL changes targeted registry keys rather than file system objects.
- File System: Collect ACL snapshots of the modified directory using: icacls <path> /save acl_snapshot.txt — compare to a known-good baseline.
- Windows Security Log — filter EventID 4670 with ObjectName matching the targeted path. Export as EVTX for forensic preservation.
- VSS / Volume Shadow Copy — if available, compare file permissions against shadow copies to establish a timeline of permission changes.
- Linux auditd logs (if applicable): ausearch -k file_perm_change or audit.log entries for syscalls chmod, fchmod, chown, fchown, setxattr.
Escalation Criteria
- !Permissions modified on SAM, NTDS.dit, SECURITY hive, /etc/shadow, or /etc/passwd — immediate credential compromise response required.
- !System binaries in C:\Windows\System32\ or /usr/bin/ targeted — indicates preparation for binary replacement or hijack execution flow attack.
- !Bulk permission modification across many files or directories in rapid succession — consistent with ransomware pre-encryption staging (BlackCat, Qilin, Medusa patterns).
- !Permission change on a security tool's executable or directory (EDR agent, AV binary, SIEM agent) — indicates active defense evasion and attacker presence.
- !takeown.exe or /setowner used on files owned by SYSTEM or TrustedInstaller — unauthorized ownership transfer suggests root-level compromise or kernel exploitation.
- !Modification performed by a service account or non-interactive account that has no legitimate business need to modify ACLs.
- !Permission change followed immediately by file execution from the modified path — confirms weaponization of the access control bypass.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Security Event Log: Event ID 4670 (Permissions on object changed) — includes SubjectUserName, ObjectName, OldSd (old security descriptor), NewSd (new security descriptor). Requires Audit Object Access policy. - >
Windows Security Event Log: Event ID 4663 (Object access attempt) correlated to the modified object post-permission-change. - >
Prefetch: C:\Windows\Prefetch\ICACLS.EXE-*.pf, TAKEOWN.EXE-*.pf, CACLS.EXE-*.pf — execution timestamps and accessed file references. - >
File System: ACL state on modified files — retrievable via: Get-Acl <path> | Format-List or icacls <path>. Compare to SDDL baseline. - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services — service binary paths that may have been targeted for permission widening to enable DLL hijacking. - >
USNJournal (C:\$Extend\$UsnJrnl:$J) — records file attribute and permission change timestamps at the NTFS level, even if Security logs were cleared. - >
Linux auditd: /var/log/audit/audit.log — syscall records for chmod(2), fchmod(2), chown(2), fchown(2), lchown(2), setxattr(2) with process context. - >
Linux: /var/log/auth.log or /var/log/secure — sudo usage for permission commands (sudo chmod, sudo chown) with timestamp and invoking user. - >
macOS: Unified System Log — entries from kernel for permission changes; use: log show --predicate 'process == "chmod"' --info. - >
VSS Shadow Copies — compare ACLs of targeted files at different points in time using: vssadmin list shadows and mounting prior snapshots.
Tuning Guidance
Begin by baselining which accounts and parent processes legitimately invoke icacls and takeown in your environment. The highest-volume sources are typically: (1) software installers called from msiexec — exclude by parent process and correlate with change management tickets; (2) backup agents with known service account names; (3) IT automation scripts from known management hosts. Build allowlists keyed on the combination of AccountName + InitiatingProcessFileName + target path prefix — never allowlist the tool name alone. Elevate severity to high whenever the target path includes credential stores (SAM, NTDS, /etc/shadow), security tool directories, or system binaries. The bulk execution hunting query (5+ hits in 15 minutes) should be treated as critical with no tuning suppression — ransomware staging windows are short and suppressing this pattern risks missing an active attack. For PowerShell Set-Acl detections, combine with DeviceNetworkEvents to identify whether a download or C2 connection preceded the ACL change, which transforms a medium-confidence event into a high-confidence incident. Enable Security Event ID 4670 audit (requires Object Access auditing policy) to capture the actual before/after security descriptor strings, which provide authoritative evidence of what changed and support rollback.
Hunting Queries
Hunt for permission modification tools invoked by script hosts or LOLBins (wscript, cscript, mshta, rundll32, regsvr32). Legitimate software installations use msiexec or dedicated installers — scripting engines and proxy executables spawning icacls/takeown is a strong indicator of malicious automation or macro-delivered malware.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("icacls.exe", "cacls.exe", "takeown.exe", "attrib.exe")
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe", "cmd.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe", "svchost.exe")
| where InitiatingProcessCommandLine !has "MsiExec" and InitiatingProcessCommandLine !has "TiWorker"
| summarize Count=count(), TargetPaths=make_set(ProcessCommandLine), Devices=dcount(DeviceName) by InitiatingProcessFileName, AccountName, bin(Timestamp, 1h)
| where Count > 2
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\icacls.exe" OR Image="*\\cacls.exe" OR Image="*\\takeown.exe" OR Image="*\\attrib.exe")
(ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\mshta.exe" OR ParentImage="*\\rundll32.exe" OR ParentImage="*\\regsvr32.exe")
| stats count as Count, values(CommandLine) as TargetPaths, dc(host) as Devices by ParentImage, User, span(_time, 1h)
| where Count > 1
| sort - CountHunt specifically for permission tools targeting high-value Windows directories: System32, SysWOW64, Windows Defender installation path, Security Account Manager config, and event log directories. These locations are targeted by malware seeking to disable security tools, dump credentials, or tamper with audit logs.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "icacls.exe" or FileName =~ "cacls.exe" or FileName =~ "takeown.exe"
| where ProcessCommandLine has_any (
"C:\\Windows\\System32\\",
"C:\\Windows\\SysWOW64\\",
"C:\\Program Files\\",
"C:\\ProgramData\\Microsoft\\Windows Defender",
"C:\\Windows\\System32\\config\\",
"C:\\Windows\\System32\\winevt"
)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\icacls.exe" OR Image="*\\cacls.exe" OR Image="*\\takeown.exe")
(CommandLine="*\\Windows\\System32\\*" OR CommandLine="*\\Windows\\SysWOW64\\*" OR CommandLine="*\\Program Files\\*" OR CommandLine="*\\Windows Defender*" OR CommandLine="*\\System32\\config\\*" OR CommandLine="*\\winevt*")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _timeHunt for bulk permission modification activity — 5 or more icacls/takeown executions within a 15-minute window on a single host. This pattern is characteristic of ransomware pre-encryption staging (BlackCat/ALPHV, Qilin, Medusa) that systematically removes ACL restrictions from target directories before beginning file encryption or destruction.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("icacls.exe", "takeown.exe", "cacls.exe")
| summarize
CmdCount = count(),
UniquePaths = dcount(ProcessCommandLine),
Commands = make_set(ProcessCommandLine, 20),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by DeviceName, AccountName, bin(Timestamp, 15m)
| where CmdCount >= 5
| extend Duration = datetime_diff('minute', LastSeen, FirstSeen)
| sort by CmdCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\icacls.exe" OR Image="*\\takeown.exe" OR Image="*\\cacls.exe")
| bin _time span=15m
| stats count as CmdCount, dc(CommandLine) as UniquePaths, values(CommandLine) as Commands, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, User, _time
| where CmdCount >= 5
| eval DurationSecs=LastSeen-FirstSeen
| sort - CmdCountAtomic Red Team Tests
Creates a test file and uses icacls to grant the Everyone group full control, removing restrictions. This simulates the pattern used by ransomware and post-exploitation tooling to ensure access to files before modification, encryption, or exfiltration. Uses a temp file to avoid impacting production paths.
Command
echo test content > %TEMP%\df00tech-acl-test.txt && icacls %TEMP%\df00tech-acl-test.txt /grant Everyone:(F) /T /C /QCleanup
icacls %TEMP%\df00tech-acl-test.txt /reset && del %TEMP%\df00tech-acl-test.txtExpected Telemetry
Sysmon Event ID 1: Process Create with Image=icacls.exe, CommandLine containing '/grant Everyone:(F)'. Security Event ID 4670 (if Object Access auditing enabled) showing the permission change on the temp file. Security Event ID 4688 (if process auditing enabled) with command line.
Expected Detection
Alert fires on icacls.exe execution with GrantsEveryone=true and GrantsFullControl=true. KQL: SuspicionScore >= 2. SPL: SuspicionScore >= 2.
Simulates the two-step permission takeover sequence: first use takeown to claim ownership of a file, then use icacls to grant the current user full control. This pattern is used by attackers to override ACLs on files they don't own, including system files and credential stores. Test uses a temp file.
Command
echo test > %TEMP%\df00tech-takeown-test.txt && takeown /F %TEMP%\df00tech-takeown-test.txt && icacls %TEMP%\df00tech-takeown-test.txt /grant %USERNAME%:(F)Cleanup
del %TEMP%\df00tech-takeown-test.txtExpected Telemetry
Two Sysmon Event ID 1 entries: first for takeown.exe with /F flag, second for icacls.exe with /grant flag. Security Event ID 4670 for the ACL change. Security Event ID 4672 (Special Privileges Assigned) if run with elevated rights. The sequential execution of takeown then icacls within a short time window is a high-confidence indicator.
Expected Detection
Alert fires twice — once for takeown.exe (TakeOwnership=true) and once for icacls.exe (GrantsFullControl=true). KQL: TakeOwnership=true. SPL: TakeOwnership=1.
Uses PowerShell's Set-Acl cmdlet to programmatically grant the current user full control over a test directory. This is a stealthier approach than invoking icacls directly and is used by sophisticated tooling and post-exploitation frameworks to modify permissions from within a PowerShell session.
Command
New-Item -ItemType Directory -Path $env:TEMP\df00tech-setacl-test -Force; $acl = Get-Acl $env:TEMP\df00tech-setacl-test; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule('Everyone','FullControl','ContainerInherit,ObjectInherit','None','Allow'); $acl.AddAccessRule($rule); Set-Acl -Path $env:TEMP\df00tech-setacl-test -AclObject $aclCleanup
Remove-Item -Recurse -Force $env:TEMP\df00tech-setacl-test -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Set-Acl', 'FileSystemAccessRule', 'Everyone', 'FullControl', and 'AddAccessRule'. PowerShell ScriptBlock Log Event ID 4104 capturing the full ACL manipulation code. Security Event ID 4670 on the target directory.
Expected Detection
Alert fires on PowerShell process with IsPowerShellACL=true. KQL: IsPowerShellACL=true, command line matches Set-Acl and FileSystemAccessRule. SPL: IsPowerShellACL=1.
Uses icacls to remove inherited ACL entries from a directory and converts inherited permissions to explicit ones, then strips them. The /inheritance:r flag removes the inheritance link, and /inheritance:d disables inheritance while preserving existing permissions. This is used by adversaries to prevent parent directory permission changes from cascading down to a malicious payload directory.
Command
mkdir %TEMP%\df00tech-inherit-test && icacls %TEMP%\df00tech-inherit-test /inheritance:rCleanup
icacls %TEMP%\df00tech-inherit-test /inheritance:e && rmdir /S /Q %TEMP%\df00tech-inherit-testExpected Telemetry
Sysmon Event ID 1: Process Create with Image=icacls.exe and CommandLine containing '/inheritance:r'. Security Event ID 4670 showing the removal of inherited ACEs (Access Control Entries) from the directory. The OldSd field in Event 4670 will show inherited entries, NewSd will show none.
Expected Detection
Alert fires on icacls.exe with RemovesInheritance=true. KQL: RemovesInheritance=true, SuspicionScore >= 1. SPL: RemovesInheritance=1.
Uses attrib.exe to remove Hidden and System file attributes from a test file. Adversaries use this technique to restore visibility of previously hidden malware components for re-execution, or to clear attributes on files they want to modify. Also used to remove the ReadOnly attribute from protected configuration files prior to tampering.
Command
echo hidden content > %TEMP%\df00tech-attrib-test.txt && attrib +H +S %TEMP%\df00tech-attrib-test.txt && attrib -H -S -R %TEMP%\df00tech-attrib-test.txtCleanup
del %TEMP%\df00tech-attrib-test.txtExpected Telemetry
Two Sysmon Event ID 1 entries for attrib.exe: first with +H +S flags (adding attributes), second with -H -S -R flags (removing attributes). Security Event ID 4663 if file auditing is enabled. The attribute removal (-H -S -R) invocation is the malicious indicator — the first is included to simulate the full adversary workflow.
Expected Detection
Alert fires on attrib.exe execution. The -H -S -R pattern indicates attribute removal. KQL: FileName=~'attrib.exe', IsPermTool=true. SPL: IsTool=1.