{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/acl-tampering/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","windows","acl-tampering"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis threat involves the use of native Windows administrative utilities - specifically \u003ccode\u003eicacls.exe\u003c/code\u003e, \u003ccode\u003ecacls.exe\u003c/code\u003e, and \u003ccode\u003excacls.exe\u003c/code\u003e - to alter the security descriptors of files and directories on compromised endpoints. Attackers leverage these built-in tools to manipulate Access Control Lists (ACLs), effectively granting themselves privileged access, restricting security software from accessing malicious artifacts, or impeding incident response efforts.\u003c/p\u003e\n\u003cp\u003eThis activity is commonly observed during the execution phase of campaigns, such as those employing Amadey malware, where adversaries aim to protect their persistence mechanisms and data exfiltration tools from administrative discovery. By modifying permissions, actors can prevent security tools from reading, deleting, or remediating malicious files, thereby maintaining control over the compromised system. Monitoring for these specific command-line execution patterns is critical for identifying unauthorized modifications of system security posture.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established on the victim endpoint (e.g., via phish or exploit).\u003c/li\u003e\n\u003cli\u003eMalware payload (e.g., Amadey) is executed on the target system.\u003c/li\u003e\n\u003cli\u003eThe attacker drops secondary components or malicious artifacts into a directory.\u003c/li\u003e\n\u003cli\u003eThe attacker executes \u003ccode\u003eicacls.exe\u003c/code\u003e to modify the security descriptor of the directory or file.\u003c/li\u003e\n\u003cli\u003eThe command includes flags such as /grant, /deny, /P, or /E to change the access rights.\u003c/li\u003e\n\u003cli\u003eThe modified permissions restrict access to the file for administrative or system accounts.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains persistence while protecting the malicious payload from investigation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful manipulation of file permissions can lead to a total loss of visibility for security operations teams and automated detection platforms. Attackers can prevent the deletion of malware, block forensic software from reading critical files, and preserve malicious persistence mechanisms. This technique is frequently observed across various campaigns, particularly where coinminers or infostealers are deployed, impacting the integrity of the endpoint and complicating recovery efforts for system administrators.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect the execution of \u003ccode\u003eicacls.exe\u003c/code\u003e or \u003ccode\u003ecacls.exe\u003c/code\u003e with permission modification flags.\u003c/li\u003e\n\u003cli\u003eIngest Sysmon Event ID 1 or Windows Security Event 4688 logs into the SIEM to ensure command-line visibility.\u003c/li\u003e\n\u003cli\u003eEnable process creation logging globally to capture the full command-line arguments used during permission changes.\u003c/li\u003e\n\u003cli\u003eTune detections against legitimate administrative activities, such as software installers or backup scripts, that may legitimately modify ACLs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:07:28Z","date_published":"2026-10-12T18:07:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-icacls-tampering/","summary":"Adversaries, including those using Amadey malware, utilize Windows utilities like icacls.exe to modify file permissions, facilitating defense evasion and persistence by hindering security analysis.","title":"Windows File and Directory Permission Tampering via icacls.exe","url":"https://feed.craftedsignal.io/briefs/2026-10-icacls-tampering/"}],"language":"en","title":"CraftedSignal Threat Feed - Acl-Tampering","version":"https://jsonfeed.org/version/1.1"}