Abuse of Native Windows Utilities to Modify File Permissions

Threat actors, including Advanced Persistent Threats (APTs) and operators of malicious payloads such as coinminers, frequently utilize native Windows file permission utilities to facilitate defense evasion. By executing commands using icacls.exe, cacls.exe, or xcacls.exe with deny flags (e.g., /deny, /d), adversaries can strip administrative or security software access from specific directories or files. This behavior is specifically intended to impede incident response efforts, disrupt security agents, and secure malicious components from deletion or inspection. Defenders should prioritize visibility into process execution command-line arguments to identify unauthorized modifications to system or application directory access control lists.

Impact

Successful execution of these commands allows attackers to effectively hide malicious artifacts, prevent security software from accessing or scanning critical files, and maintain long-term persistence within a compromised host. This technique is commonly observed in the aftermath of initial access to prevent automated cleanup or manual remediation by security teams.

Recommendation

Prioritize the implementation of process-creation logging to capture full command-line arguments for file-permission manipulation tools. Deploy the Sigma rules below to monitor for suspicious usage of deny-access flags. Investigate any instances where these utilities are invoked by processes other than system installers or configuration management tools.