T1222.002 Linux and Mac File and Directory Permissions Modification Mappings

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Most Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: <code>chown</code> (short for change owner), and <code>chmod</code> (short for change mode).

Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via .bash_profile and .bashrc or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-16 Security and Privacy Attributes Protects T1222.002 Linux and Mac File and Directory Permissions Modification
AC-2 Account Management Protects T1222.002 Linux and Mac File and Directory Permissions Modification
AC-3 Access Enforcement Protects T1222.002 Linux and Mac File and Directory Permissions Modification
AC-5 Separation of Duties Protects T1222.002 Linux and Mac File and Directory Permissions Modification
AC-6 Least Privilege Protects T1222.002 Linux and Mac File and Directory Permissions Modification
CA-7 Continuous Monitoring Protects T1222.002 Linux and Mac File and Directory Permissions Modification
CM-5 Access Restrictions for Change Protects T1222.002 Linux and Mac File and Directory Permissions Modification
CM-6 Configuration Settings Protects T1222.002 Linux and Mac File and Directory Permissions Modification
IA-2 Identification and Authentication (organizational Users) Protects T1222.002 Linux and Mac File and Directory Permissions Modification
SI-4 System Monitoring Protects T1222.002 Linux and Mac File and Directory Permissions Modification
SI-7 Software, Firmware, and Information Integrity Protects T1222.002 Linux and Mac File and Directory Permissions Modification
azure_security_center_recommendations Azure Security Center Recommendations technique_scores T1222.002 Linux and Mac File and Directory Permissions Modification
file_integrity_monitoring File Integrity Monitoring technique_scores T1222.002 Linux and Mac File and Directory Permissions Modification