PowerShell Script Change Permission Via Set-Acl - PsScript

Rule Info

Name
PowerShell Script Change Permission Via Set-Acl - PsScript
Author
frack113, Nasreddine Bencherchali (Nextron Systems)
Description
Detects PowerShell scripts set ACL to of a file or a folder
Reference
https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md
Date
2023-07-18 00:00:00
Modified
None
Id
cae80281-ef23-44c5-873b-fd48d2666f49
Tags
attack.defense-evasion attack.t1222
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=cae80281-ef23-44c5-873b-fd48d2666f49

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
github-actions[bot]
Merge PR #4867 from @nasbench - Promote older rules status from `experimental` to `test`
2024-06-03
d84959e50
frack113
feat: add rules related to pwsh set-acl cmdlet usage (#4352)
2023-07-20
9acc4e182
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022