QilinS1242 ↗
Can use symbolic links to redirect file paths for remote and local objects and can use chmod +x to make its payload binary executable.12
tfMITRE ATT&CK technique
File and Directory Permissions Modification T1222
- Tactic
- Defense Impairment
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 3.0
- Created
- 17 October 2018
- Last modified
- 12 May 2026
- Contributors
- CrowdStrike Falcon OverWatch; Jan Miller, CrowdStrike
Sub-techniques 239 rules across the family · 9 mapped directly to T1222 · 2 of 2 carry rules
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.[1][2] File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.9
Detection rules73rd pct
Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.File and Directory Permissions Modification MITRE reference T1222
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1222
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 7
first rule: 2021 Q2File and Directory Permissions Modification detection strategy DET0299
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Multi-Platform File and Directory Permissions Modification Detection Strategy
4 platforms
AN0834 · Windows
Sequential behavioral chain of privilege escalation through permission modification: (1) Process creation of permission-modifying utilities (icacls, takeown, attrib, cacls), (2) Correlation with unusual user context or timing, (3) DACL modification events targeting sensitive files/directories, (4) Subsequent file access or modification attempts indicating successful privilege bypass
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File MetadataDC0059 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Active Directory Object ModificationDC0066 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Temporal correlation window for linking permission modification with subsequent access attempts (default: 300 seconds) |
| SensitivePathList | Environment-specific critical file and directory paths requiring permission change monitoring |
| TrustedUserContext | Administrative accounts authorized to perform legitimate permission modifications |
| BusinessHoursThreshold | Time-based threshold for elevated alerting on permission changes outside business hours |
AN0835 · Linux
Behavioral sequence of unauthorized privilege escalation via permission modification: (1) chmod/chown/setfacl process execution with suspicious parameters, (2) Targeting of critical system files or unusual permission values, (3) Correlation with non-privileged user context or unusual timing patterns, (4) Follow-on file access indicating successful permission bypass
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File MetadataDC0059 | auditd:SYSCALL | syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr) |
| Command ExecutionDC0064 | auditd:PROCTITLE | proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SuspiciousPermissionValues | Octal permission values that indicate potential malicious intent (default: 777, 755, 4755) |
| CriticalPathPatterns | Linux filesystem paths requiring enhanced monitoring (/etc/, /usr/bin/, /home/) |
| AuthorizedAdminUsers | User accounts permitted to perform system-level permission modifications |
| AnomalyThreshold | Statistical threshold for detecting unusual permission modification frequency |
AN0836 · macOS
macOS-specific permission modification behavioral chain: (1) chmod/chown/chflags process execution, (2) System Integrity Protection (SIP) bypass attempts, (3) Extended attribute (xattr) modifications, (4) Unified log correlation with file system events, (5) Subsequent access to previously restricted resources
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process execution events for chmod, chown, chflags with unusual parameters or targets |
| File MetadataDC0059 | fs:fsevents | file system events indicating permission or attribute changes |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SIPProtectedPaths | macOS system paths protected by SIP that should never have permission modifications |
| SuspiciousFlagCombinations | chflags parameter combinations indicating evasive behavior (uchg, schg, hidden) |
| XattrMonitoringScope | Extended attributes to monitor for unauthorized modifications |
| UnifiedLogRetention | Log retention period for correlating permission changes with subsequent access |
AN0837 · ESXi
ESXi hypervisor permission modification behavioral chain: (1) SSH access to ESXi host, (2) chmod/chown execution on VMFS datastore files or system configuration, (3) Modification of VM configuration files (.vmx) or virtual disk permissions, (4) Hostd service log correlation, (5) vCenter permission change events if centrally managed
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File MetadataDC0059 | esxi:hostd | host daemon events related to file or VM permission changes |
| Command ExecutionDC0064 | esxi:shell | shell command execution for chmod, chown, or file permission modification on VMFS or system files |
| Active Directory Object ModificationDC0066 | esxi:vpxd | permission change operations on datastores or VMs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthorizedSSHUsers | ESXi user accounts authorized for shell access and file system operations |
| CriticalVMFSPaths | VMFS datastore paths requiring permission change monitoring |
| ShellAccessTimeWindow | Time correlation window for linking SSH access with permission modifications |
| vCenterIntegrationScope | Scope of vCenter audit event correlation with ESXi host activities |
Ensure critical system files as well as those known to be abused by adversaries have restrictive permissions and are owned by an appropriately privileged account, especially if access is not required by users nor will inhibit system functionality.
Applying more restrictive permissions to files and directories could prevent adversaries from modifying their access control lists. Additionally, ensure that user settings regarding local and remote symbolic links are properly set or disabled where unneeded.
Tests3Executorscmd 2 · PowerShell 1Need elevation3 of 3Have prerequisites0Have cleanup3Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |
|---|---|---|---|---|---|---|---|---|
| 01 | Enable Local and Remote Symbolic Links via fsutil | windows | cmd | Required | — | Yes | ||
Use fsutil to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths. reference Attack command fsutil behavior set SymlinkEvaluation R2L:1 fsutil behavior set SymlinkEvaluation R2R:1 Cleanup command fsutil behavior set SymlinkEvaluation R2L:0 fsutil behavior set SymlinkEvaluation R2R:0 GUID549667d0-2716-426a-8253-15a7a7fd657f | ||||||||
| 02 | Enable Local and Remote Symbolic Links via reg.exe | windows | cmd | Required | — | Yes | ||
Use reg.exe to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths. reference Attack command reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToLocalEvaluation /t REG_DWORD /d "1" /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToRemoteEvaluation /t REG_DWORD /d "1" /f Cleanup command reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToLocalEvaluation /t REG_DWORD /d "0" /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v SymlinkRemoteToRemoteEvaluation /t REG_DWORD /d "0" /f GUID5b183555-cad3-4dbb-a140-4053f1c1b356 | ||||||||
| 03 | Enable Local and Remote Symbolic Links via Powershell | windows | PowerShell | Required | — | Yes | ||
Use Powershell to enable both ‘remote to local’ and ‘remote to remote’ symbolic links. This allows access to files from local shortcuts with local or remote paths. reference Attack command New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToLocalEvaluation -PropertyType DWORD -Value 1 -Force -ErrorAction Ignore New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToRemoteEvaluation -PropertyType DWORD -Value 1 -Force -ErrorAction Ignore Cleanup command New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToLocalEvaluation -PropertyType DWORD -Value 0 -Force -ErrorAction Ignore New-ItemProperty -Path HKLM:\Software\Policies\Microsoft\Windows\Filesystems\NTFS -Name SymlinkRemoteToRemoteEvaluation -PropertyType DWORD -Value 0 -Force -ErrorAction Ignore GUID8589e764-a384-4e37-ab91-3a62229656c3 | ||||||||
Tests from Atomic Red Team (MIT licence) · technique definition