huntrule

Windows process-based detection of file and folder permission changes via ACL tools

Alerts when Windows permission/ownership changes are attempted using ACL and ownership tools with grant/inheritance-related command-line flags.

FreeUnreviewedSigmamediumv1
title: Windows process-based detection of file and folder permission changes via ACL tools
id: 46c583ca-5da6-4594-991d-aa2096cf71be
status: test
description: This rule flags Windows processes that modify file or folder permissions using common command-line utilities. It identifies likely permission tampering by matching executions of cacls.exe, icacls.exe, net.exe/net1.exe (grant/share), and attributing flags like /grant, /setowner, or inheritance changes, along with related takeown.exe and attrib.exe switches. Detection relies on process creation telemetry including the executable path/name and the full command line, and it excludes specific known benign permission reset/grant patterns for Dynatrace and local software paths for optional environments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md
  - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh750728(v=ws.11)
  - https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_file_permission_modifications.yml
author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-23
modified: 2023-11-21
tags:
  - attack.defense-impairment
  - attack.t1222.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    Image|endswith:
      - \cacls.exe
      - \icacls.exe
      - \net.exe
      - \net1.exe
    CommandLine|contains:
      - /grant
      - /setowner
      - /inheritance:r
  selection_2:
    Image|endswith: \attrib.exe
    CommandLine|contains: -r
  selection_3:
    Image|endswith: \takeown.exe
  filter_optional_dynatrace_1:
    CommandLine|endswith: ICACLS C:\ProgramData\dynatrace\gateway\config\connectivity.history /reset
  filter_optional_dynatrace_2:
    CommandLine|contains|all:
      - "ICACLS C:\\ProgramData\\dynatrace\\gateway\\config\\config.properties /grant :r "
      - S-1-5-19:F
  filter_optional_vscode:
    CommandLine|contains:
      - \AppData\Local\Programs\Microsoft VS Code
      - :\Program Files\Microsoft VS Code
  filter_optional_avira:
    CommandLine|contains:
      - :\Program Files (x86)\Avira
      - :\Program Files\Avira
  condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
  - Users interacting with the files on their own (unlikely unless privileged users).
  - Dynatrace app
level: medium
license: DRL-1.1
related:
  - id: 37ae075c-271b-459b-8d7b-55ad5f993dd8
    type: derived

What it detects

This rule flags Windows processes that modify file or folder permissions using common command-line utilities. It identifies likely permission tampering by matching executions of cacls.exe, icacls.exe, net.exe/net1.exe (grant/share), and attributing flags like /grant, /setowner, or inheritance changes, along with related takeown.exe and attrib.exe switches. Detection relies on process creation telemetry including the executable path/name and the full command line, and it excludes specific known benign permission reset/grant patterns for Dynatrace and local software paths for optional environments.

Known false positives

  • Users interacting with the files on their own (unlikely unless privileged users).
  • Dynatrace app

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.