T1222.001 Windows File and Directory Permissions Modification Mappings

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).(Citation: Microsoft DACL May 2018) Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied.(Citation: Microsoft Access Control Lists May 2018)

Adversaries can interact with the DACLs using built-in Windows commands, such as icacls, cacls, takeown, and attrib, which can grant adversaries higher permissions on specific files and folders. Further, PowerShell provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-16 Security and Privacy Attributes Protects T1222.001 Windows File and Directory Permissions Modification
AC-2 Account Management Protects T1222.001 Windows File and Directory Permissions Modification
AC-3 Access Enforcement Protects T1222.001 Windows File and Directory Permissions Modification
AC-5 Separation of Duties Protects T1222.001 Windows File and Directory Permissions Modification
AC-6 Least Privilege Protects T1222.001 Windows File and Directory Permissions Modification
CA-7 Continuous Monitoring Protects T1222.001 Windows File and Directory Permissions Modification
CM-5 Access Restrictions for Change Protects T1222.001 Windows File and Directory Permissions Modification
CM-6 Configuration Settings Protects T1222.001 Windows File and Directory Permissions Modification
IA-2 Identification and Authentication (organizational Users) Protects T1222.001 Windows File and Directory Permissions Modification
SI-4 System Monitoring Protects T1222.001 Windows File and Directory Permissions Modification
SI-7 Software, Firmware, and Information Integrity Protects T1222.001 Windows File and Directory Permissions Modification
action.malware.variety.Disable controls Disable or interfere with security controls related-to T1222.001 File and Directory Permissions Modification: Windows File and Directory Permissions Modification