Anvilogic high experimental spl
Permissions Replaced by icacls - Windows [splunk-winevent]
icacls is a command-line utility in Windows that allows for viewing and modifying Discretionary Access Control Lists (DACLs) and file permissions. Threat actors may abuse this tool to alter file permissions, potentially gaining unauthorized access or control over sensitive files and directories, as observed by DFIR report (see references). This use case detects icacls executions with switches to replace permissions. -- Threat Actor Association: FIN7 (aka. Carbon Spider, Sangria Tempest)
Detection Logic
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688)
OR "<EventID>4688<"
OR Type=Process) "icacls" ("/grant:"
OR "/deny:"
OR "/remove:"
OR "/setintegritylevel:"
OR "/inheritance:")
| rex field=_raw "(?<=icacls\.exe\"\s)(?<file_path>[^\s]+)"
| rex field=_raw "/(grant
| deny
| remove
| setintegritylevel
| inheritance):\S\s(?<permission_user>[^\:]+):F"
| table _time, host, user, process, process_*, parent_process, parent_process_*, user, file_path, permission_user
| bin span=1s
| stats values(*) as * by _time, hostField Validations
Loading…
Comments (0)
Loading comments...