QilinS1242 ↗
Can use symbolic links to redirect file paths for remote and local objects and can use chmod +x to make its payload binary executable.12
tfMITRE ATT&CK technique
File and Directory Permissions Modification T1222
- Tactic
- Defense Impairment
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 3.0
- Created
- 17 October 2018
- Last modified
- 12 May 2026
- Contributors
- CrowdStrike Falcon OverWatch; Jan Miller, CrowdStrike
Sub-techniques 239 rules across the family · 9 mapped directly to T1222 · 2 of 2 carry rules
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.[1][2] File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.9
Detection rules73rd pct
Detection rules73rd percentile · 71% of ATT&CK techniques have fewer detection rules written.