File and Directory Permissions Modification

T1222

Technique with 2 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, Unix Shell Configuration Modification, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.

Adversaries may also change permissions of symbolic links. For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.

Detection rules38

Rules on DetectionCode tagged with T1222 or one of its sub-techniques.

Sigma9

Rule	Level	Log source	Technique
AD Object WriteDAC Access	critical	windows / NULL	T1222.001
PowerShell Set-Acl On Windows Folder - PsScript	high	windows / ps_script	T1222
Chmod Targeting Sensitive Directories	medium	linux / process_creation	T1222.002
Potentially Suspicious NTFS Symlink Behavior Modification	medium	windows / process_creation	T1222.001
Remove Immutable File Attribute	medium	linux / process_creation	T1222.002
Remove Immutable File Attribute - Auditd	medium	linux / NULL	T1222.002
Suspicious Recursive Takeown	medium	windows / process_creation	T1222.001
File or Folder Permissions Change	low	linux / NULL	T1222.002
PowerShell Script Change Permission Via Set-Acl - PsScript	low	windows / ps_script	T1222

Splunk29

Rule	Type	Risk	Data source	Technique
Excessive Usage Of Cacls App	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222
Hiding Files And Directories With Attrib exe	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222.001
Icacls Deny Command	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222
ICACLS Grant Command	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222
Linux Auditd Change File Owner To Root	Anomaly	NULL	Linux Auditd Proctitle	T1222.002
Linux Auditd File Permission Modification Via Chmod	Anomaly	NULL	Linux Auditd Proctitle	T1222.002
Linux Auditd File Permissions Modification Via Chattr	Anomaly	NULL	Linux Auditd Execve	T1222.002
Linux Change File Owner To Root	Anomaly	NULL	Sysmon for Linux EventID 1	T1222.002
Modify ACL permission To Files Or Folder	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222
Permission Modification using Takeown App	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222
Windows AD Dangerous Deny ACL Modification	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD Dangerous Group ACL Modification	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD Dangerous User ACL Modification	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD DCShadow Privileges ACL Addition	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD Domain Root ACL Deletion	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD Domain Root ACL Modification	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD GPO New CSE Addition	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD Hidden OU Creation	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD Object Owner Updated	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD Suspicious Attribute Modification	TTP	NULL	Windows Event Log Security 5136	T1222.001
Windows AD Suspicious GPO Modification	TTP	NULL	Windows Event Log Security 5136, Windows Event Log Security 5145	T1222.001
Windows Common Abused Cmd Shell Risk Behavior	Correlation	NULL		T1222
Windows File and Directory Enable ReadOnly Permissions	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1222.001
Windows File and Directory Permissions Enable Inheritance	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1222.001
Windows File and Directory Permissions Remove Inheritance	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1222.001
Windows Files and Dirs Access Rights Modification Via Icacls	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222.001
Windows SubInAcl Execution	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222.001
Windows SymbolicLink-Testing-Tools Utility Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222
Windows Symlink Evaluation Change via Fsutil	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1222.001

Sub-techniques2

ID	Name	Examples
T1222.001	Windows Permissions	12
T1222.002	Linux and Mac Permissions	15

Groups0

None recorded.

Software1

Qilin

Campaigns0

None recorded.

Procedure examples1

Software1

Used by	Procedure example
MalwareQilin	Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable. Cisco Talos Qilin Ransomware OCT 2025 Picus Qilin MAR 2025

References7

Hybrid Analysis Icacls1 June 2018 Open source
Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018.
Hybrid Analysis Icacls2 May 2018 Open source
Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018.
bad_luck_blackcat Open source
Kaspersky Global Research & Analysis Team (GReAT). (2022). A Bad Luck BlackCat. Retrieved May 5, 2022.
blackmatter_blackcat Open source
Pereira, T. Huey, C. (2022, March 17). From BlackMatter to BlackCat: Analyzing two attacks from one affiliate. Retrieved May 5, 2022.
falconoverwatch_blackcat_attack Open source
Falcon OverWatch Team. (2022, March 23). Falcon OverWatch Threat Hunting Contributes to Seamless Protection Against Novel BlackCat Attack. Retrieved May 5, 2022.
fsutil_behavior Open source
Microsoft. (2021, September 27). fsutil behavior. Retrieved January 14, 2022.
new_rust_based_ransomware Open source
Symantec Threat Hunter Team. (2021, December 16). Noberus: Technical Analysis Shows Sophistication of New Rust-based Ransomware. Retrieved January 14, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.