File and Directory Permissions Modification
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every analytic in DET0299 is a child's mechanism, and the two children partition the parent's platform space completely. AN0834 is Windows-only and names icacls.exe, takeown.exe, attrib.exe and cacls.exe on Security 4688 plus 4670/4656 DACL modification — that is verbatim the first stage of AN1177 in T1222.001 (Windows Permissions, DET0418), whose brief carries the same 4688 and 4670/4656 log sources and adds 4658 and WMI 5857-5861 on top. AN0835 is Linux chmod/chown/setfacl on auditd SYSCALL and PROCTITLE, which is verbatim the first stage of AN0998 in T1222.002 (Linux and Mac Permissions, DET0351), whose brief carries the same two auditd sources and adds linux:osquery. AN0836 is macOS chmod/chown/chflags on macos:unifiedlog, which is AN0999 in the same child, which additionally offers OpenBSM audittrail. […]
What the technique is
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.). Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, Unix Shell Configuration Modification, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow. Adversaries may also change permissions of symbolic links. For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0834
Sequential behavioral chain of privilege escalation through permission modification: (1) Process creation of permission-modifying utilities (icacls, takeown, attrib, cacls), (2) Correlation with unusual user context or timing, (3) DACL modification events targeting sensitive files/directories, (4) Subsequent file access or modification attempts indicating successful privilege bypass
- AN0835
Behavioral sequence of unauthorized privilege escalation via permission modification: (1) chmod/chown/setfacl process execution with suspicious parameters, (2) Targeting of critical system files or unusual permission values, (3) Correlation with non-privileged user context or unusual timing patterns, (4) Follow-on file access indicating successful permission bypass
- AN0836
macOS-specific permission modification behavioral chain: (1) chmod/chown/chflags process execution, (2) System Integrity Protection (SIP) bypass attempts, (3) Extended attribute (xattr) modifications, (4) Unified log correlation with file system events, (5) Subsequent access to previously restricted resources
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.