Suspicious Use Icacls to Hide File to Everyone (via process_creation)

title: Suspicious Use Icacls to Hide File to Everyone (via process_creation)
id: 970324a8-b902-5c2f-9f1f-de61f0a61ff6
status: stable
description: This rule detects use of icacls to deny access for everyone in Users folder sometimes used to hide hostile files
references:
    - https://attack.mitre.org/techniques/T1564/001/
    - https://app.any.run/tasks/1df999e6-1cb8-45e3-8b61-499d1b7d5a9b/
author: Huntrule Team
date: 2026-02-11
tags:
    - attack.stealth
    - attack.t1564.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_icacls:
        - OriginalFileName: 'iCACLS.EXE'
        - Image|endswith: '\icacls.exe'
    selection_cmd:
        CommandLine|contains|all:
            - '/deny'
            - '*S-1-1-0:'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium