Rule Info
Name
Files or Folders Permission Modification
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects file or folders permissions changes through built-in Windows utilities like icacls.exe and cacls.exe.
Adversaries may want to change permissions of files or directories for encryption, deletion, or other malicious purposes.
Date
2025-03-14 00:00:00
Modified
None
Id
d83a1b32-6f89-4b8a-945f-b2e3e8fbbd52
Tags
attack.defense-evasion attack.t1222.001
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR