Windows DACL or ownership seized with a built-in permissions tool

Siemphony@siemphonymediumT1222.001verified in lab

AN1177 describes a five-stage chain — a permissions utility launches, its command line reveals intent, a 4670 DACL change follows, a 4663 access succeeds, and persistence follows that. Only the first two stages survive the Sigma subset this corpus models: the analytic's own TemporalCorrelationWindow knob asks for a 300-second join across three event ids, and lib/sigma has no aggregation, no timeframe and no near, so the correlation is simply absent here and a match means one command ran, not that any access actually changed hands. The rule therefore takes the process-creation leg and gates it twice — the tool must be a DACL editor and the command line must carry an access-changing switch — because those binaries are also the standard way to *read* an ACL, and an unqualified `icacls C:\path` is a query, not a modification. The two tool families need separate gates because their switch vocabularies do not overlap: icacls takes /grant, /deny, /setowner and /inheritance:r, while the older cacls and xcacls spell the same operations /g, /r, /p and /d, so one switch list checked against both would leave the legacy binaries permanently unmatched. attrib.exe, which the analytic also names, is deliberately out of scope: it sets file attributes rather than a DACL, and hiding a file with attrib +h is T1564.001. takeown.exe gets its own selection with no argument gate: it has no read-only mode, so every invocation is an ownership seizure. A third selection covers the .NET/PowerShell equivalents the analytic names, matched on the command line of any process, which catches only one-liners — an ACL rewritten inside a .ps1 body or by a compiled binary calling SetSecurityInfo directly produces no process-creation record at all and is invisible here. Two deployment caveats. The brief maps this leg to Security EventID 4688, so the rule is written in the Sysmon-shaped `process_creation` vocabulary (Image, CommandLine) that Sigma backends map onto NewProcessName and CommandLine for 4688; if 4688 is the feed, *Audit Process Creation* must be enabled AND the separate *Include command line in process creation events* policy must be on, or every CommandLine term below is blind and the rule returns zero rows while looking healthy. MITRE's SuspiciousCommandLinePatterns and SensitivePathWhitelist knobs name where the tuning goes; the switch list and the tool list below were assembled here, not taken from MITRE. UNVERIFIED — derived from MITRE ATT&CK DET0418 and never executed against logs.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((((FolderPath endswith "\\icacls.exe" and (ProcessCommandLine contains "/grant" or ProcessCommandLine contains "/deny" or ProcessCommandLine contains "/remove" or ProcessCommandLine contains "/setowner" or ProcessCommandLine contains "/inheritance:r" or ProcessCommandLine contains "/reset" or ProcessCommandLine contains "/setintegritylevel")) or ((FolderPath endswith "\\cacls.exe" or FolderPath endswith "\\xcacls.exe") and (ProcessCommandLine contains " /g " or ProcessCommandLine contains " /r " or ProcessCommandLine contains " /p " or ProcessCommandLine contains " /d "))) or FolderPath endswith "\\takeown.exe") or (ProcessCommandLine contains "Set-Acl" or ProcessCommandLine contains "SetAccessRule" or ProcessCommandLine contains "AddAccessRule" or ProcessCommandLine contains "SetAccessRuleProtection" or ProcessCommandLine contains "SetOwner"))

Splunk · SPL

Run this as a search.

index=* ((((Image="*\\icacls.exe" AND (CommandLine="*/grant*" OR CommandLine="*/deny*" OR CommandLine="*/remove*" OR CommandLine="*/setowner*" OR CommandLine="*/inheritance:r*" OR CommandLine="*/reset*" OR CommandLine="*/setintegritylevel*")) OR ((Image="*\\cacls.exe" OR Image="*\\xcacls.exe") AND (CommandLine="* /g *" OR CommandLine="* /r *" OR CommandLine="* /p *" OR CommandLine="* /d *"))) OR Image="*\\takeown.exe") OR (CommandLine="*Set-Acl*" OR CommandLine="*SetAccessRule*" OR CommandLine="*AddAccessRule*" OR CommandLine="*SetAccessRuleProtection*" OR CommandLine="*SetOwner*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((((TO_LOWER(process.executable) LIKE "*\\\\icacls.exe" AND (TO_LOWER(process.command_line) LIKE "*/grant*" OR TO_LOWER(process.command_line) LIKE "*/deny*" OR TO_LOWER(process.command_line) LIKE "*/remove*" OR TO_LOWER(process.command_line) LIKE "*/setowner*" OR TO_LOWER(process.command_line) LIKE "*/inheritance:r*" OR TO_LOWER(process.command_line) LIKE "*/reset*" OR TO_LOWER(process.command_line) LIKE "*/setintegritylevel*")) OR ((TO_LOWER(process.executable) LIKE "*\\\\cacls.exe" OR TO_LOWER(process.executable) LIKE "*\\\\xcacls.exe") AND (TO_LOWER(process.command_line) LIKE "* /g *" OR TO_LOWER(process.command_line) LIKE "* /r *" OR TO_LOWER(process.command_line) LIKE "* /p *" OR TO_LOWER(process.command_line) LIKE "* /d *"))) OR TO_LOWER(process.executable) LIKE "*\\\\takeown.exe") OR (TO_LOWER(process.command_line) LIKE "*set-acl*" OR TO_LOWER(process.command_line) LIKE "*setaccessrule*" OR TO_LOWER(process.command_line) LIKE "*addaccessrule*" OR TO_LOWER(process.command_line) LIKE "*setaccessruleprotection*" OR TO_LOWER(process.command_line) LIKE "*setowner*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 4 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\icacls\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(/grant|/deny|/remove|/setowner|/inheritance:r|/reset|/setintegritylevel)</field>    <description>Windows DACL or ownership seized with a built-in permissions tool (1/4)</description>    <mitre>      <id>T1222.001</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\cacls\.exe$|\\xcacls\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( /g | /r | /p | /d )</field>    <description>Windows DACL or ownership seized with a built-in permissions tool (2/4)</description>    <mitre>      <id>T1222.001</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\takeown\.exe$</field>    <description>Windows DACL or ownership seized with a built-in permissions tool (3/4)</description>    <mitre>      <id>T1222.001</id>    </mitre>  </rule>   <rule id="100003" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Set-Acl|SetAccessRule|AddAccessRule|SetAccessRuleProtection|SetOwner)</field>    <description>Windows DACL or ownership seized with a built-in permissions tool (4/4)</description>    <mitre>      <id>T1222.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: file_permission_tampering
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 3 Sept 2026
Rule ID: bd80c2d3-662d-4202-bc6d-3b562611b228

ATT&CKT1222.001

T1222.001Windows Permissions

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonfile permission tampering

file permission tamperingAI draft — unreviewed

01 · What this rule detects

AN1177 describes a five-stage chain: a permissions utility launches, its command line reveals intent, a 4670 DACL change follows, a 4663 access succeeds, persistence follows that. Only the first two stages survive the Sigma subset this corpus models, so the rule detects exactly one thing — a Windows built-in permission editor invoked with an argument that rewrites a DACL or seizes ownership. A match means that command ran. It does not mean any access actually changed hands.

02 · Telemetry you need

process_creation / windows, copied from the brief. The rule is written in the Sysmon-shaped vocabulary (Image, CommandLine), which Sysmon EventID 1 supplies natively. If your feed is Security EventID 4688 instead, backends map those fields onto NewProcessName/CommandLine — but two policies must both be on: Audit Process Creation, and the separate Include command line in process creation events. Without the second, every CommandLine term below is blind and the rule returns zero rows, which reads as quiet when it means deaf. The analytic's 4670 and 4663 legs are unused, so no SACL work is needed.

03 · How the logic works

Four selections, OR-ed:

selection_icacls_tool is Image|endswith: '\icacls.exe', gated on /grant, /deny, /remove, /setowner, /inheritance:r, /reset, /setintegritylevel. The gate carries the whole rule: bare icacls C:\path is a read, so ungated the selection would match every ACL query on the estate. cacls.exe and xcacls.exe need their own pair because they spell the same operations /g, /r, /p, /d; one switch list checked against all three binaries leaves the two legacy tools permanently unmatched — which is what the first draft did, and it validated clean in four backends anyway. selection_takeown has no argument gate: takeown.exe has no read-only mode, so every invocation is an ownership seizure. selection_managed_acl matches Set-Acl, SetAccessRule, AddAccessRule, SetAccessRuleProtection, SetOwner on any process's command line — one-liners only, and object-type-agnostic, since those .NET methods also exist on RegistrySecurity and ActiveDirectorySecurity, so registry and AD-object ACL edits will surface under this tag. attrib.exe, which AN1177 also names, is excluded deliberately: it sets attributes, not a DACL, and attrib +h is T1564.001.

04 · Common false positives

Loudly, and on a schedule. Installers and MSI custom actions run icacls /grant against their own Program Files and ProgramData directories at setup and on every upgrade — on a patched fleet that is the highest-volume match by a wide margin. CI workers and Dockerfile RUN steps do the same per job under a service account. SetupComplete.cmd and sysprep scripts trip the ungated takeown selection under SYSTEM on every freshly imaged host. And helpdesk profile recovery is literally takeown /f /r /d y followed by icacls /grant — the exact sequence this rule is shaped to catch.

05 · Detection maturity

tier_1: the lowest tier — and it stays there until it has been run against real data. It has never seen a log line. TemporalCorrelationWindow is what defines
tier_2: here: without the 4670/4663 join, this is an intent signal, not evidence that a permission changed.
tier_3: is that correlation plus a path and account baseline.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names the knobs: SensitivePathWhitelist, AuthorizedAdministratorAccounts, SuspiciousCommandLinePatterns and TemporalCorrelationWindow. The switch list and the binary list in the rule are the pipeline's own, not MITRE's. Exclude build-agent and installer service accounts first, then SYSTEM-context takeown inside the first-boot window, then scope what is left to paths you actually care about. The rule ships at medium; review flagged that as unsupported, since all four false positives are recurring automation. low is the honest level until those exclusions exist.

Declared by the author

Application installers and MSI custom actions. A large share of line-of-business software, driver packages and game launchers run icacls /grant against their own Program Files subdirectory, log folder or ProgramData store during setup and again on every version upgrade, and many run icacls /reset or /inheritance:r first. On a fleet with active patching this is the highest-volume match by a wide margin and it is why this rule is scored medium rather than high.
Helpdesk and migration remediation. Recovering a user profile, a departed employee's home directory or a moved file share is routinely done as takeown /f /r /d y followed by icacls /grant, which is exactly the two-command sequence this rule is shaped to catch, run by an administrator with a ticket number.
Build agents and container image builds. CI workers and Dockerfile RUN steps call icacls /grant or /reset on a workspace, a NuGet cache or an IIS content directory on every job, so a busy pipeline produces the same event hundreds of times a day under a service account.
Windows servicing and OEM provisioning scripts. SetupComplete.cmd, sysprep specialise-pass scripts and some cumulative-update cleanup routines invoke takeown and icacls under SYSTEM during boot, which trips the unconditional takeown selection on every freshly imaged host.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Windows file permissions modification
passed
Siemphony IR · 3 Sept 2026
3 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1222.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/bd80c2d3-662d-4202-bc6d-3b562611b228

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Windows DACL or ownership seized with a built-in permissions tool

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it