T1222.001 — Windows Permissions

T1222.001 File and Directory Permissions Modification: Windows Permissions

title: "T1222.001 File and Directory Permissions Modification: Windows Permissions"
id: d3f4cfbf-be3a-44a4-bf26-5c9845cf0e16
description: 'Detects modification of Windows file/directory DACLs via icacls, cacls, xcacls, or takeown, or via PowerShell Set-Acl, consistent with an adversary altering ACLs to evade access controls or reach protected files. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: SensitivePathWhitelist, AuthorizedAdministratorAccounts, SuspiciousCommandLinePatterns.'
references:
  - https://attack.mitre.org/techniques/T1222/001
author: Shahrukh Khan
date: 2026-01-23
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1222.001

logsource:
  category: process_creation
  product: windows

detection:
  selection_tools:
    Image|endswith:
      - '\icacls.exe'
      - '\cacls.exe'
      - '\xcacls.exe'
      - '\takeown.exe'
  selection_flags:
    CommandLine|contains:
      - '/grant'
      - '/deny'
      - '/remove:g'
      - '/remove:d'
      - '/setowner'
      - '/inheritance:r'
  selection_powershell_acl:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Set-Acl'
      - 'Set-ACL'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: ((selection_tools and selection_flags) or selection_powershell_acl) and not filter_system_account

falsepositives:
  - Software installers and IT deployment/configuration-management scripts that legitimately modify ACLs via icacls/takeown/Set-Acl.

level: medium