Browse Rules

File Permission Modification in Writable Directory

Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution.

File and Directory Permissions Modification

Identifies the change of permissions/ownership of files/folders through built-in Windows utilities. Threat actors may require permission modification of files/folders to change, modify or delete them.

System Binary Path File Permission Modification

This rule identifies file permission modification events on files located in common system binary paths. Adversaries may attempt to hide their payloads in the default Linux system directories, and modify the file permissions of these payloads prior to execution.

Azure Storage Blob Container Permissions Modified

Detects when permissions are modified on an Azure Storage blob container. Adversaries may modify container permissions to enable public access, grant unauthorized access, or prepare for data exfiltration. Changes to blob permissions can indicate attempts to access sensitive data, establish persistence through external access, or facilitate ransomware by modifying access controls before encryption.

System Boot Files Permission Change

Identifies attempts to change file ownership of system boot critical files. Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files.

Full Control Permissions Granted to Everyone - Windows [snowflake-crowdstrikefdr_process]

Adversaries may modify file or directory permissions/attributes to evade access control lists and access protected files. Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs). Adversaries can interact with the DACLs using built-in Windows commands which can grant adversaries higher permissions on specific files and folders. This use case detects commands assigning full control to Everyone which has been observed with Ryuk ransomware. -- Threat Actor Associatio

Slack Private Channel Made Public

Detects when a channel that was previously private is made public

Full Control Permissions Granted to Everyone - Windows [splunk-sysmon]

Adversaries may modify file or directory permissions/attributes to evade access control lists and access protected files. Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs). Adversaries can interact with the DACLs using built-in Windows commands which can grant adversaries higher permissions on specific files and folders. This use case detects commands assigning full control to Everyone which has been observed with Ryuk ransomware. -- Threat Actor Associatio

Full Control Permissions Granted to Everyone - Windows [splunk-winevent]

Adversaries may modify file or directory permissions/attributes to evade access control lists and access protected files. Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs). Adversaries can interact with the DACLs using built-in Windows commands which can grant adversaries higher permissions on specific files and folders. This use case detects commands assigning full control to Everyone which has been observed with Ryuk ransomware. -- Threat Actor Associatio

Permissions Replaced by icacls - Windows [splunk-edr]

icacls is a command-line utility in Windows that allows for viewing and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat actors may abuse this tool to alter file permissions, potentially gaining unauthorized access or control over sensitive files and directories, as observed by DFIR report (see references). This use case detects icacls executions with switches to replace permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)

Permissions Replaced by icacls - Windows [splunk-powershell]

icacls is a command-line utility in Windows that allows for viewing and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat actors may abuse this tool to alter file permissions, potentially gaining unauthorized access or control over sensitive files and directories, as observed by DFIR report (see references). This use case detects icacls executions with switches to replace permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)

Permissions Replaced by icacls - Windows [splunk-sysmon]

icacls is a command-line utility in Windows that allows for viewing and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat actors may abuse this tool to alter file permissions, potentially gaining unauthorized access or control over sensitive files and directories, as observed by DFIR report (see references). This use case detects icacls executions with switches to replace permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)

Permissions Replaced by icacls - Windows [snowflake-crowdstrikefdr_process]

icacls is a command-line utility in Windows that allows for viewing and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat actors may abuse this tool to alter file permissions, potentially gaining unauthorized access or control over sensitive files and directories, as observed by DFIR report (see references). This use case detects icacls executions with switches to replace permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)

Permissions Replaced by icacls - Windows [splunk-winevent]

icacls is a command-line utility in Windows that allows for viewing and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat actors may abuse this tool to alter file permissions, potentially gaining unauthorized access or control over sensitive files and directories, as observed by DFIR report (see references). This use case detects icacls executions with switches to replace permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)

Potential Privilege Escalation via File Redirection

Identifies suspicious modification of an executable file in a protected Windows directory and by a medium or low integrity process. This may indicate an attempt to elevate privileges via privileged file redirection vulnerabilities or weak permissions.

Forest Blizzard APT - JavaScript Constrained File Creation

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

Forest Blizzard APT - JavaScript Constrained File Creation

Detects the creation of JavaScript files inside of the DriverStore directory. Forest Blizzard used this to exploit the CVE-2022-38028 vulnerability in Windows Print Spooler service by modifying a JavaScript constraints file and executing it with SYSTEM-level permissions.

Windows File and Directory Enable ReadOnly Permissions

The following analytic detects instances where file or folder permissions are modified to grant read-only access. Such changes are characterized by the presence of read-related permissions (e.g., R, REA, RA, RD) and the absence of write (W) or execute (E) permissions. Monitoring these events is crucial for tracking access control changes that could be intentional for restricting access or indicative of malicious behavior. Alerts generated by this detection help ensure that legitimate security me

Permission Modification using Takeown App

The following analytic detects the modification of file or directory permissions using the takeown.exe Windows application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include process GUID, process name, and command-line details. This activity is significant because it is a common technique used by ransomware to take ownership of files or folders for encryption or deletion. If confirmed malicious, this could lead to unauthorized ac

Windows Files and Dirs Access Rights Modification Via Icacls

The following analytic identifies the modification of security permissions on files or directories using tools like icacls.exe, cacls.exe, or xcacls.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line executions. This activity is significant as it is commonly used by Advanced Persistent Threats (APTs) and coinminer scripts to evade detection and maintain control over compromised systems. If confirmed malicious, this behavior could allow att

Access Control List Modification via setfacl

This rule detects Linux Access Control List (ACL) modification via the setfacl command. Attackers may use the setfacl utility to modify file and directory permissions in order to evade detection and maintain persistence on a compromised system.

Suspicious File Made Executable via Chmod Inside A Container

This rule detects when chmod or chown are used to add the execute permission to a file in a world-writeable directory, and inside of a container. Modifying file permissions to make a file executable could indicate malicious activity, as an attacker may attempt to run unauthorized or malicious code inside the container.

Recently Downloaded File Made Executable and Run

This rule detects a sequence of events where a network connection is initiated to download a file to a world-writeable directory, followed by the execution of a chmod or chown command, and then another process execution. This pattern may indicate an attacker attempting to download a payload, modify its permissions to make it executable, and then execute it.

ScreenConnect User Database Modification - Security

This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.

ScreenConnect User Database Modification - Security

This detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server. This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions. This requires an Advanced Auditing policy to log a successful Windows Event ID 4663 events and with a SACL set on the directory.