Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1222

T1222File and Directory Permissions Modification

T1222 — File and Directory Permissions Modification is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 7 detection use cases covering it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
7Use cases
0Articles
2Sub-techniques
1Tactic

Sub-techniques (2)

T1222.002 · Linux and Mac PermissionsT1222.001 · Windows Permissions

Use cases covering this technique (7)

Excessive Usage Of Cacls App ESCU actions · hunting P Icacls Deny Command ESCU actions · hunting P ICACLS Grant Command ESCU actions · hunting P Modify ACL permission To Files Or Folder ESCU actions · hunting P Permission Modification using Takeown App ESCU actions · hunting P Windows Common Abused Cmd Shell Risk Behavior ESCU actions · alerting P Windows SymbolicLink-Testing-Tools Utility Execution ESCU actions · alerting P