CmdID

CmdID / Techniques / T1222

T1222.002 File and Directory Permissions Modification: Linux and Mac Permissions

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. MITRE ATT&CK

1 program on CmdID 2 Sigma rules T1222.002 on attack.mitre.org

Part of

MITRE ATT&CK
T1222File and Directory Permissions Modification

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
chmodits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
mediumChmod Targeting Sensitive DirectoriesChristopher Peacock @SecurePeacock, SCYTHE @scythe_io · Linux
mediumRemove Immutable File AttributeNasreddine Bencherchali (Nextron Systems) · Linux

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Make a file or directory mutable on the page for chattr

sudo chattr -i path/to/file_or_directoryIdentify

An example is here when CmdID’s reading of it names T1222.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.