MITRE ATT&CKsub-technique

T1222.001 Windows Permissions

Published 2020-02-04 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Defense Impairment
Platforms
Windows
Version
2.0
Created
2020-02-04

Description

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.). Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs). Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object. When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order. If a matching entry is found, access to the object is granted. Otherwise, access is denied. Adversaries can interact with the DACLs using built-in Windows commands, such as `icacls`, `cacls`, `takeown`, and `attrib`, which can grant adversaries higher permissions on specific files and folders. Further, PowerShell provides cmdlets that can be used to retrieve or modify file and directory DACLs. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1222 File and Directory Permissions Modification technique

Tactic · MITRE ATT&CK (1)

  • TA0112 Defense Impairment tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1022 Restrict File and Directory Permissions mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (14)

  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • S9002 Diskpart software (tool)
  • G1046 Storm-1811 group
  • S1180 BlackByte Ransomware software (malware)
  • S1068 BlackCat software (malware)
  • S0693 CaddyWiper software (malware)
  • S0612 WastedLocker software (malware)
  • S0570 BitPaymer software (malware)
  • S0531 Grandoreiro software (malware)
  • S0446 Ryuk software (malware)
  • G0102 Wizard Spider group
  • S0366 WannaCry software (malware)
  • S0201 JPIN software (malware)

Referenced by Compliance · mitigates (11)

  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References