Rule Info
Name
ICACLS Deny Permission Abuse
Author
X__Junior
Description
Detects execution of icacls.exe with deny arguments targeting broad principals such as Everyone or Administrators, which may indicate malicious permission tampering.
Date
2026-02-20 00:00:00
Modified
None
Id
a2c4c383-26af-4741-beba-9cce9c84a7e3
Tags
attack.defense-evasion attack.t1562.001
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR