Anvilogic high experimental other
Permissions Replaced by icacls - Windows [snowflake-crowdstrikefdr_process]
icacls is a command-line utility in Windows that allows for viewing and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat actors may abuse this tool to alter file permissions, potentially gaining unauthorized access or control over sensitive files and directories, as observed by DFIR report (see references). This use case detects icacls executions with switches to replace permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)
Detection Logic
select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and process_path ilike '%icacls%' and regexp_like(process, '.*/(grant
| deny
| remove
| setintegritylevel
| inheritance):.*', 'i')Field Validations
Loading…
Comments (0)
Loading comments...