CmdID

CmdID / Commands

cacls

IMPORTANT: This command has been deprecated. Windows commands reference

On Windows 1 Sigma rule name it File cacls.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

IMPORTANT: This command has been deprecated. Please use icacls instead. Displays or modifies discretionary access control lists (DACL) on specified files.

cacls <filename> [/t] [/m] [/l] [/s[:sddl]] [/e] [/c] [/g user:<perm>] [/r user [...]] [/p user:<perm> [...]] [/d user [...]]
Show 18 options
<filename>Required. Displays ACLs of specified files.
/tChanges ACLs of specified files in the current directory and all subdirectories.
/mChanges ACLs of volumes mounted to a directory.
/lWorks on the Symbolic Link itself instead of the target.
/s:sddlReplaces the ACLs with those specified in the SDDL string. This parameter is not valid for use with the /e, /g, /r, /p, or /d parameters.
/eEdit an ACL instead of replacing it.
/cContinue after access denied errors.
/g user:<perm>Grants specified user access rights, including these valid values for permission: - n - None - r - Read - w - Write - c - Change (write) - f - Full control
/r user [...]Revoke specified user's access rights. Only valid when used with the /e parameter.
/?Displays help at the command prompt.
OIObject inherit. This folder and files.
CIContainer inherit. This folder and subfolders.
IOInherit only. The ACE does not apply to the current file/directory.
No output messageThis folder only.
(OI)(CI)This folder, subfolders, and files.
(OI)(CI)(IO)Subfolders and files only.
(CI)(IO)Subfolders only.
(OI)(IO)Files only.

What detects it

Sigma process creation rules that name cacls
mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)