T1222.002 — Linux and Mac Permissions

Tactic: Defense Impairment · Platforms: Linux, macOS

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL…

Sub-technique of File and Directory Permissions Modification (T1222).

Sigma detection rules (2)

T1222.002 File and Directory Permissions Modification: Linux and Mac Permissions

title: "T1222.002 File and Directory Permissions Modification: Linux and Mac Permissions"
id: e7a8dd4f-6484-4f10-9074-b6dbbafae0b0
description: 'Unix-like File Permission Manipulation Behavioral Chain Detection Strategy. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SuspiciousPermissionValues, CriticalSystemPaths, AuthorizedSystemAdministrators, TemporalCorrelationWindow, RecursiveOperationThreshold, ACLComplexityBaseline.'
references:
  - https://attack.mitre.org/techniques/T1222/002
author: Shahrukh Khan
date: 2026-06-19
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1222.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/chmod'
      - '/chown'
      - '/setfacl'
    a1|contains:
      - '-R'
      - '777'

  condition: selection

falsepositives:
  - Legitimate recursive ownership fixes after a migration or deployment by system administrators; scope to CriticalSystemPaths and require a non-admin AuthorizedSystemAdministrators mismatch for higher fidelity.

level: high

T1222.002 File and Directory Permissions Modification: Linux and Mac Permissions

title: "T1222.002 File and Directory Permissions Modification: Linux and Mac Permissions"
id: f2830c16-65db-471a-8234-0f71acb1d688
description: 'Unix-like File Permission Manipulation Behavioral Chain Detection Strategy. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SIPProtectedPaths, SuspiciousFileFlags, CriticalExtendedAttributes, GatekeeperBypassIndicators, ApplicationBundleMonitoring, UnifiedLogRetentionPeriod.'
references:
  - https://attack.mitre.org/techniques/T1222/002
author: Shahrukh Khan
date: 2026-04-18
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1222.002

logsource:
  category: file_change
  product: macos

detection:
  selection_xattr:
    TargetFilename|contains: '.app/'
  selection_cmd:
    Image|endswith:
      - '/xattr'
      - '/codesign'
      - '/spctl'
  selection_flag:
    CommandLine|contains:
      - '-d com.apple.quarantine'
      - '--remove-signature'
      - '--master-disable'
  condition: (selection_xattr or selection_cmd) and selection_flag

falsepositives:
  - Developers legitimately strip the quarantine attribute from their own unsigned build artifacts during local testing, so this should be reviewed for whether the target application bundle originated from an external download.

level: high

Related sub-techniques

Explore