T1222.001 File and Directory Permissions Modification: Windows Permissions

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. MITRE ATT&CK

Part of

MITRE ATT&CK

T1222File and Directory Permissions Modification

process creation, the highest levels first

criticalWannaCry Ransomware ActivityFlorian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · Windows

mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

everyday examples from tldr-pages, CC BY 4.0

To remove the Read-only attribute from files in the public directory and its subdirectories on a disk in drive b:, type on the page for attrib

attrib -r b:\public\*.* /sIdentify

Remove a specific attribute of files or directories on the page for attrib

attrib -r path\to\file_or_directory1 path\to\file_or_directory2 ...Identify

To grant the user User1 Delete and Write DAC permissions to a file named Test1, type on the page for icacls

icacls test1 /grant User1:(d,wdac)Identify

To grant the user defined by SID S-1-1-0 Delete and Write DAC permissions to a file named TestFile, type on the page for icacls

icacls TestFile /grant *S-1-1-0:(d,wdac)Identify

To take ownership of a file named Lostfile, type on the page for takeown

takeown /f lostfileIdentify

Take ownership of the specified file on the page for takeown

takeown /f path\to\fileIdentify

Take ownership of the specified directory on the page for takeown

takeown /d path\to\directoryIdentify

Take ownership of the specified directory and all subdirectories on the page for takeown

takeown /r /d path\to\directoryIdentify

Change ownership to the Administrator group instead of the current user on the page for takeown

takeown /a /f path\to\fileIdentify

An example is here when CmdID’s reading of it names T1222.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.