cacls
IMPORTANT: This command has been deprecated. Windows commands reference
On Windows 1 Sigma rule name it File cacls.exe
Windows
IMPORTANT: This command has been deprecated. Please use icacls instead. Displays or modifies discretionary access control lists (DACL) on specified files.
cacls <filename> [/t] [/m] [/l] [/s[:sddl]] [/e] [/c] [/g user:<perm>] [/r user [...]] [/p user:<perm> [...]] [/d user [...]]
Show 18 options
<filename>Required. Displays ACLs of specified files./tChanges ACLs of specified files in the current directory and all subdirectories./mChanges ACLs of volumes mounted to a directory./lWorks on the Symbolic Link itself instead of the target./s:sddlReplaces the ACLs with those specified in the SDDL string. This parameter is not valid for use with the /e, /g, /r, /p, or /d parameters./eEdit an ACL instead of replacing it./cContinue after access denied errors./g user:<perm>Grants specified user access rights, including these valid values for permission:
- n - None
- r - Read
- w - Write
- c - Change (write)
- f - Full control/r user [...]Revoke specified user's access rights. Only valid when used with the /e parameter./?Displays help at the command prompt.OIObject inherit. This folder and files.CIContainer inherit. This folder and subfolders.IOInherit only. The ACE does not apply to the current file/directory.No output messageThis folder only.(OI)(CI)This folder, subfolders, and files.(OI)(CI)(IO)Subfolders and files only.(CI)(IO)Subfolders only.(OI)(IO)Files only.What detects it
mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)