T1222 File and Directory Permissions Modification

Technique

T1222

Tactics

Defense Evasion

Research, 90 days

2

KEV CVEs mapped

1

SigmaHQ rules

2

Elastic, Splunk

25

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1222

MITRE description

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.). Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574). Adversaries may also change permissions of symbolic links. For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.(Citation: new_rust_based_ransomware)(Citation: bad_luck_blackcat)(Citation: falconoverwatch_blackcat_attack)(Citation: blackmatter_blackcat)(Citation: fsutil_behavior)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2022-22960

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize

Detection coverage

SigmaHQ community rules

• PowerShell Set-Acl On Windows Folder - PsScript (core)
• PowerShell Script Change Permission Via Set-Acl - PsScript (core)

Elastic and Splunk rules

• Azure Blob Storage Permissions Modified (elastic)
• Azure Blob Storage Container Access Level Modified (elastic)
• File Execution Permission Modification Detected via Defend for Containers (elastic)
• GCP Storage Bucket Permissions Modification (elastic)
• ESXi File Made Executable with chmod (elastic)
• Access Control List Modification via setfacl (elastic)
• File made Immutable by Chattr (elastic)
• File Creation in World-Writable Directory by Unusual Process (elastic)
• File Permission Modification in Writable Directory (elastic)
• Suspicious File Made Executable via Chmod Inside A Container (elastic)
• System Binary Path File Permission Modification (elastic)
• Executable Bit Set for Potential Persistence Script (elastic)
• Potential Unauthorized Access via Wildcard Injection Detected (elastic)
• Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities (elastic)
• Adding Hidden File Attribute via Attrib (elastic)
• System File Ownership Change (elastic)
• File and Directory Permissions Modification (elastic)
• WRITEDAC Access on Active Directory Object (elastic)
• Excessive Usage Of Cacls App (splunk)
• Icacls Deny Command (splunk)
• ICACLS Grant Command (splunk)
• Modify ACL permission To Files Or Folder (splunk)
• Permission Modification using Takeown App (splunk)
• Windows Common Abused Cmd Shell Risk Behavior (splunk)
• Windows SymbolicLink-Testing-Tools Utility Execution (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.