{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1222","id":"T1222","name":"File and Directory Permissions Modification","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1222","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"be50b495d58322b776bc01a86b2a856442909a17c87c04c2bdabd4c61153f495","description":"Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\n\nModifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).\n\nAdversaries may also change permissions of symbolic links. For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.(Citation: new_rust_based_ransomware)(Citation: bad_luck_blackcat)(Citation: falconoverwatch_blackcat_attack)(Citation: blackmatter_blackcat)(Citation: fsutil_behavior) ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1222","external_id":"T1222"},{"source_name":"falconoverwatch_blackcat_attack","description":"Falcon OverWatch Team. (2022, March 23). Falcon OverWatch Threat Hunting Contributes to Seamless Protection Against Novel BlackCat Attack. Retrieved May 5, 2022.","url":"https://www.crowdstrike.com/blog/falcon-overwatch-contributes-to-blackcat-protection/"},{"source_name":"Hybrid Analysis Icacls1 June 2018","description":"Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018.","url":"https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100"},{"source_name":"Hybrid Analysis Icacls2 May 2018","description":"Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018.","url":"https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110"},{"source_name":"bad_luck_blackcat","description":"Kaspersky Global Research & Analysis Team (GReAT). (2022). A Bad Luck BlackCat. Retrieved May 5, 2022.","url":"https://go.kaspersky.com/rs/802-IJN-240/images/TR_BlackCat_Report.pdf"},{"source_name":"fsutil_behavior","description":"Microsoft. (2021, September 27). fsutil behavior. Retrieved January 14, 2022.","url":"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior"},{"source_name":"blackmatter_blackcat","description":"Pereira, T. Huey, C. (2022, March 17). From BlackMatter to BlackCat: Analyzing two attacks from one affiliate. Retrieved May 5, 2022.","url":"https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html"},{"source_name":"new_rust_based_ransomware","description":"Symantec Threat Hunter Team. (2021, December 16). Noberus: Technical Analysis Shows Sophistication of New Rust-based Ransomware. Retrieved January 14, 2022.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-alphv-rust-ransomware"}],"platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1222.001","id":"T1222.001","name":"Windows Permissions","page":"techniques/enterprise/T1222.001/"},{"key":"enterprise/T1222.002","id":"T1222.002","name":"Linux and Mac Permissions","page":"techniques/enterprise/T1222.002/"}],"telemetry":[{"id":"DC0066","name":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an Active Directory object attribute.","collection_focus":"Enable Audit Directory Service Changes with appropriate object SACLs on lab DCs; retain 5136 attribute/value and correlation context.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_dn","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0059","name":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component","category":"Host state and inventory","description":"File attributes such as path, size, timestamps, ownership and cryptographic hash.","collection_focus":"Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["path","size_bytes","sha256","owner_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1222","id":"T1222","name":"File and Directory Permissions Modification","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1222","technique_page":"techniques/enterprise/T1222/","page":"detections/enterprise/T1222/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[{"id":"cae80281-ef23-44c5-873b-fd48d2666f49","title":"PowerShell Script Change Permission Via Set-Acl - PsScript","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"},"data_path":"data/detection-rules/cae80281-ef23-44c5-873b-fd48d2666f49.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_set_acl.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"3bf1d859-3a7e-44cb-8809-a99e066d3478","title":"PowerShell Set-Acl On Windows Folder - PsScript","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"},"data_path":"data/detection-rules/3bf1d859-3a7e-44cb-8809-a99e066d3478.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_set_acl_susp_location.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1222-1","technique_id":"T1222","title":"T1222 File and Directory Permissions Modification","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":107,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L107","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"27aec53d57994681733815f5245697c6fc19f216b6eb4bb63abdd22945116528","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(permission_or_owner_change_on_protected_path) AND actor NOT_IN approved_admins -> ALERT","log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Linux Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#31-linux-audit-logs"},{"title":"File-Integrity Monitoring Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#14-file-integrity-monitoring-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0299","name":"Multi-Platform File and Directory Permissions Modification Detection Strategy","url":"https://attack.mitre.org/detectionstrategies/DET0299","stix_id":"x-mitre-detection-strategy--682ddf59-6de3-4765-a1c0-09b539fa5d4f","relationship_id":"relationship--3f78696b-0ec4-4d0c-9e65-5bb26ee3ebe7","description":"","analytics":[{"id":"AN0834","name":"Analytic 0834","guidance":"Sequential behavioral chain of privilege escalation through permission modification: (1) Process creation of permission-modifying utilities (icacls, takeown, attrib, cacls), (2) Correlation with unusual user context or timing, (3) DACL modification events targeting sensitive files/directories, (4) Subsequent file access or modification attempts indicating successful privilege bypass","url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0834","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Temporal correlation window for linking permission modification with subsequent access attempts (default: 300 seconds)"},{"field":"SensitivePathList","description":"Environment-specific critical file and directory paths requiring permission change monitoring"},{"field":"TrustedUserContext","description":"Administrative accounts authorized to perform legitimate permission modifications"},{"field":"BusinessHoursThreshold","description":"Time-based threshold for elevated alerting on permission changes outside business hours"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0834","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0834","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0059","component":"File Metadata","name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","platforms":["Windows"],"analytic_id":"AN0834","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0834","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"},{"component_id":"DC0066","component":"Active Directory Object Modification","name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","platforms":["Windows"],"analytic_id":"AN0834","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0834","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0066/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0834","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0834","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN0834","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0834","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0835","name":"Analytic 0835","guidance":"Behavioral sequence of unauthorized privilege escalation via permission modification: (1) chmod/chown/setfacl process execution with suspicious parameters, (2) Targeting of critical system files or unusual permission values, (3) Correlation with non-privileged user context or unusual timing patterns, (4) Follow-on file access indicating successful permission bypass","url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0835","platforms":["Linux"],"tuning":[{"field":"SuspiciousPermissionValues","description":"Octal permission values that indicate potential malicious intent (default: 777, 755, 4755)"},{"field":"CriticalPathPatterns","description":"Linux filesystem paths requiring enhanced monitoring (/etc/, /usr/bin/, /home/)"},{"field":"AuthorizedAdminUsers","description":"User accounts permitted to perform system-level permission modifications"},{"field":"AnomalyThreshold","description":"Statistical threshold for detecting unusual permission modification frequency"}],"log_sources":[{"component_id":"DC0059","component":"File Metadata","name":"auditd:SYSCALL","channel":"syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr)","platforms":["Linux"],"analytic_id":"AN0835","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0835","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"},{"component_id":"DC0064","component":"Command Execution","name":"auditd:PROCTITLE","channel":"proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters","platforms":["Linux"],"analytic_id":"AN0835","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0835","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0836","name":"Analytic 0836","guidance":"macOS-specific permission modification behavioral chain: (1) chmod/chown/chflags process execution, (2) System Integrity Protection (SIP) bypass attempts, (3) Extended attribute (xattr) modifications, (4) Unified log correlation with file system events, (5) Subsequent access to previously restricted resources","url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0836","platforms":["macOS"],"tuning":[{"field":"SIPProtectedPaths","description":"macOS system paths protected by SIP that should never have permission modifications"},{"field":"SuspiciousFlagCombinations","description":"chflags parameter combinations indicating evasive behavior (uchg, schg, hidden)"},{"field":"XattrMonitoringScope","description":"Extended attributes to monitor for unauthorized modifications"},{"field":"UnifiedLogRetention","description":"Log retention period for correlating permission changes with subsequent access"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process execution events for chmod, chown, chflags with unusual parameters or targets","platforms":["macOS"],"analytic_id":"AN0836","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0836","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0059","component":"File Metadata","name":"fs:fsevents","channel":"file system events indicating permission or attribute changes","platforms":["macOS"],"analytic_id":"AN0836","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0836","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"}]},{"id":"AN0837","name":"Analytic 0837","guidance":"ESXi hypervisor permission modification behavioral chain: (1) SSH access to ESXi host, (2) chmod/chown execution on VMFS datastore files or system configuration, (3) Modification of VM configuration files (.vmx) or virtual disk permissions, (4) Hostd service log correlation, (5) vCenter permission change events if centrally managed","url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0837","platforms":["ESXi"],"tuning":[{"field":"AuthorizedSSHUsers","description":"ESXi user accounts authorized for shell access and file system operations"},{"field":"CriticalVMFSPaths","description":"VMFS datastore paths requiring permission change monitoring"},{"field":"ShellAccessTimeWindow","description":"Time correlation window for linking SSH access with permission modifications"},{"field":"vCenterIntegrationScope","description":"Scope of vCenter audit event correlation with ESXi host activities"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"shell command execution for chmod, chown, or file permission modification on VMFS or system files","platforms":["ESXi"],"analytic_id":"AN0837","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0837","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0059","component":"File Metadata","name":"esxi:hostd","channel":"host daemon events related to file or VM permission changes","platforms":["ESXi"],"analytic_id":"AN0837","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0837","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"},{"component_id":"DC0066","component":"Active Directory Object Modification","name":"esxi:vpxd","channel":"permission change operations on datastores or VMs","platforms":["ESXi"],"analytic_id":"AN0837","source_url":"https://attack.mitre.org/detectionstrategies/DET0299#AN0837","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0066/"}]}]}],"telemetry_references":[{"id":"DC0066","name":"Active Directory Object Modification","tag":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component"},{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0059","name":"File Metadata","tag":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can use symbolic links to redirect file paths for remote and local objects and can use  `chmod +x` to make its payload binary executable.(Citation: Picus Qilin MAR 2025)(Citation: Cisco Talos Qilin Ransomware OCT 2025)","relationship_id":"relationship--87ddd67f-3c7f-4d69-b9e4-c2526a3d609f","references":[{"source_name":"Picus Qilin MAR 2025","description":"Hacioglu, S. (2025, March 10). Qilin Ransomware: Exposing the TTPs Behind One of the Most Active Ransomware Campaigns of 2024. Retrieved September 26, 2025.","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","description":"Takeda, T. et al. (2025, October 26). Uncovering Qilin attack methods exposed through multiple cases. Retrieved March 26, 2026.","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}]}],"actors":[],"mitigations":[{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Applying more restrictive permissions to files and directories could prevent adversaries from modifying their access control lists. Additionally, ensure that user settings regarding local and remote symbolic links are properly set or disabled where unneeded.(Citation: create_sym_links)","relationship_id":"relationship--79412658-c213-4746-b03d-c828957d6ddb","references":[{"source_name":"create_sym_links","description":"Microsoft. (2021, October 28). Create symbolic links. Retrieved April 27, 2022.","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/create-symbolic-links"}]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Ensure critical system files as well as those known to be abused by adversaries have restrictive permissions and are owned by an appropriately privileged account, especially if access is not required by users nor will inhibit system functionality.","relationship_id":"relationship--9a8788d7-3f27-49b4-bb60-0b0d581fa812","references":[]}],"candidates":[{"id":"6c4ac96f-d4fa-44f4-83ca-56d8f4a55c02","name":"Enable Local and Remote Symbolic Links via fsutil","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222/T1222.yaml","description":"Use fsutil to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.\n[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)\n","inputs":{},"dependencies":[],"source_definition_sha256":"9e91766d908086f44a44635128d62d25bddd69db89801fdb8dc2b004bfac799a"},{"id":"6cd715aa-20ac-4be1-a8f1-dda7bae160bd","name":"Enable Local and Remote Symbolic Links via Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222/T1222.yaml","description":"Use Powershell to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.\n[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)\n","inputs":{},"dependencies":[],"source_definition_sha256":"8c94898656a246ce89f37ef0e52e14c3f3aa67467c2085e30a22df19f1d328a2"},{"id":"78bef0d4-57fb-417d-a67a-b75ae02ea3ab","name":"Enable Local and Remote Symbolic Links via reg.exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1222/T1222.yaml","description":"Use reg.exe to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths.\n[reference](https://symantec-enterprise-blogs.security.com/threat-intelligence/noberus-blackcat-alphv-rust-ransomware/)\n","inputs":{},"dependencies":[],"source_definition_sha256":"5c32c90cd9fd89518e6e11c686da1aaa8b2470770957318ffcf3aba9e2b9e7ab"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1546.008":"/ttp-simulation/techniques/enterprise/T1546.008/","T1037":"/ttp-simulation/techniques/enterprise/T1037/","T1546.004":"/ttp-simulation/techniques/enterprise/T1546.004/","T1574":"/ttp-simulation/techniques/enterprise/T1574/","T1222":"/ttp-simulation/techniques/enterprise/T1222/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1222","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}