tfMITRE ATT&CK sub-technique

Linux and Mac Permissions T1222.002

sub-technique of T1222 File and Directory Permissions Modification

Tactic: Defense Impairment
Platforms: Linux, macOS
Version: 2.0
Created: 04 February 2020
Last modified: 12 May 2026

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.[1][2] File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules71st pct

Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.

Linux and Mac Permissions MITRE reference T1222.002

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamTNTG0139 ↗

Has modified the permissions on binaries with chattr.1 2

created 2021-10-012 references

RockeG0106 ↗

Has changed file permissions of files so they could not be modified.1

created 2020-05-261 reference

APT32G0050 ↗

APT32's macOS backdoor changes the permission of the file it wants to execute to 755.1

created 2017-12-141 referenceaka SeaLotus

All 3 groups for this technique

11 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

DRYHOOKS9013 ↗

Has the ability to remount the filesystem as “read-write” to make changes and then restores it to “read-only” prior to killing processes to apply the modifications.1 2

created 2026-04-14MALWARE

COATHANGERS1105 ↗

Will set the GID of httpsd to 90 when infected.1

created 2024-02-07MALWARE

Black BastaS1070 ↗

The Black Basta binary can use chmod to gain full permissions to targeted files.1

created 2023-03-08MALWAREcarried by 1 group

XCSSETS0658 ↗

Uses the chmod +x command to grant executable permissions to the malicious file.1

created 2021-10-05MALWARE

P.A.S. WebshellS0598 ↗

Has the ability to modify file permissions.1

created 2021-04-13MALWAREcarried by 2 groups

KinsingS0599 ↗

Has used chmod to modify permissions on key files for use.1

created 2021-04-06MALWARE

All 11 software entries for this technique · 6 newest in this preview

Offense vs defense T1222.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 4

first rule: 2019 Q3 · 1 of 1 campaigns plotted

Linux and Mac Permissions detection strategy DET0351

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Unix-like File Permission Manipulation Behavioral Chain Detection Strategy

Enterprise

2 platforms

AN0998 · Linux

Linux permission escalation behavioral chain: (1) Process creation of permission modification utilities (chmod, chown, chgrp, setfacl) with suspicious parameters indicating privilege escalation intent, (2) System call analysis revealing direct file metadata manipulation (chmod, fchmod, chown, fchown syscalls), (3) Extended attribute and ACL modifications targeting critical system paths, (4) Temporal correlation with subsequent file access or process execution from modified locations, (5) Anomalous permission patterns deviating from system baselines

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	linux:osquery	process execution events for permission modification utilities with command-line analysis
File MetadataDC0059	auditd:SYSCALL	syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, lchown, setxattr, lsetxattr, fsetxattr, removexattr, lremovexattr, fremovexattr)
Command ExecutionDC0064	auditd:PROCTITLE	proctitle contains chmod, chown, chgrp, setfacl, or attr with suspicious parameters (777, 755, +x, -R)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousPermissionValues	Octal permission values indicating potential malicious intent - customize based on organizational security policy (default: 777, 755, 4755, 2755, 1755 for sticky/setuid/setgid)
CriticalSystemPaths	Linux filesystem paths requiring enhanced permission change monitoring - adapt to environment-specific critical directories (/etc, /usr/bin, /usr/sbin, /var, /opt, /root, /boot)
AuthorizedSystemAdministrators	User accounts and service accounts authorized for system-level permission modifications - maintain current list of legitimate administrators
TemporalCorrelationWindow	Time window for correlating permission changes with subsequent file access or process execution - adjust based on system performance (default: 300 seconds)
RecursiveOperationThreshold	Maximum depth or file count for recursive permission operations before triggering anomaly detection (-R flag monitoring)
ACLComplexityBaseline	Baseline complexity metrics for setfacl operations to detect anomalous extended ACL configurations
FileAccessFrequencyBaseline	Statistical baseline for normal file access patterns post-permission modification to detect privilege abuse

AN0999 · macOS

macOS permission and attribute manipulation behavioral chain: (1) Process execution of permission utilities (chmod, chown, chgrp) or macOS-specific tools (chflags) with suspicious parameters, (2) System Integrity Protection (SIP) bypass attempts through permission modifications, (3) File flags manipulation (uchg, schg, hidden) for evasion or persistence, (4) Extended attribute (xattr) modifications affecting security metadata, (5) Unified log correlation with file system events and subsequent access patterns, (6) Gatekeeper and code signing bypass through permission/attribute manipulation

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process execution events for chmod, chown, chflags with parameter analysis and target path examination
File MetadataDC0059	OpenBSM:AuditTrail	BSM audit events for file permission, ownership, and attribute modifications with user context
File ModificationDC0061	fs:fsevents	file system events indicating permission, ownership, or extended attribute changes on critical paths. File system modification events with kFSEventStreamEventFlagItemChangeOwner, kFSEventStreamEventFlagItemXattrMod flags

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SIPProtectedPaths	macOS system paths protected by SIP that should never have permission modifications - maintain current list based on macOS version (/System, /usr, /bin, /sbin)
SuspiciousFileFlags	chflags parameter combinations indicating potential evasive behavior - customize based on security requirements (uchg, schg, hidden, archived)
CriticalExtendedAttributes	Extended attributes requiring monitoring for unauthorized removal or modification (com.apple.quarantine, com.apple.metadata, com.apple.FinderInfo)
GatekeeperBypassIndicators	Patterns in permission/attribute changes that may indicate Gatekeeper bypass attempts
ApplicationBundleMonitoring	Scope of .app directory monitoring for internal permission modifications indicating bundle tampering
UnifiedLogRetentionPeriod	Log retention period for correlating permission changes with subsequent access patterns - balance storage with detection capability
FSEventsFilteringThreshold	File system event filtering threshold to manage high-volume environments while maintaining detection coverage

1 analytic

Adversaries sometimes modify object access rights at the operating system level. There are varying motivations behind this action - they may not want some files/objects to be changed on systems for persistence reasons and therefore provide admin only rights; also, they may want files to be accessible with lower levels of permissions.

TypeSituational AwarenessCoverageModerateSubmitted2019

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SFA	System File Analysis

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Windows environment logs can be noisy, so we take the following into consideration: * We need to exclude events generated by the local system (subject security ID "NT AUTHORITY\SYSTEM") and focus on actual user events. * When a permission modification is made for a folder, a new event log is generated for each subfolder and file under that folder. It is advised to group logs based on handle ID or user ID. * The Windows security log (event ID 4670) also includes information about the process that modifies the file permissions. It is advised to focus on uncommon process names, and it is also uncommon for real-users to perform this task without a GUI.

log_name == "Security" AND
event_code == "4670" AND
object_type == "File" AND
subject_security_id != "NT AUTHORITY\SYSTEM"

This looks for any invocations of chmod. Note that this is likely to be more noisy than the Windows-specific implementation, although Linux does not generate logs for system triggered activities like in Windows. In addition, it may be necessary to whitelist cron jobs that regularly run and execute chmod.

processes = search Process:Create
chmod_processes = filter processes where command_line == "chmod *"
output chmod_processes

Splunk version of the above pseudocode.

index=__your_windows_security_log_index__ EventCode=4670 Object_Type="File" Security_ID!="NT AUTHORITY\\SYSTEM"

LogPoint version of the above pseudocode for Windows.

norm_id=WindowsSysmon channel="Security" event_id=4670 object_type="File" -user_id="S-1-5-18"

Unit tests

CAR’s own validation procedures for this analytic.

For Windows - right click on any file and change its permissions under properties. Or, execute the following command: `icacls "C:\<fileName>" /grant :F`

For Linux - execute the following command: `chmod 777 "fileName"`

Tests14Executorssh 10 · bash 4Need elevation2 of 14Have prerequisites4Have cleanup0Platformslinux, macos

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 chmod - Change file or folder mode (numeric mode) linux, macos sh — — —

Changes a file or folder's permissions using chmod and a specified numeric mode.

Input arguments

Name	Type	Default	Description
numeric_mode	integer	755	Specified numeric mode value
file_or_folder	path	/tmp/AtomicRedTeam/atomics/T1222.002	Path of the file or folder

Attack command

chmod #{numeric_mode} #{file_or_folder}

GUIDabe1a334-6b92-4b24-948f-b92a409e49ab

02 chmod - Change file or folder mode (symbolic mode) linux, macos sh — — —

Changes a file or folder's permissions using chmod and a specified symbolic mode.

Input arguments

Name	Type	Default	Description
symbolic_mode	string	a+w	Specified symbolic mode value
file_or_folder	path	/tmp/AtomicRedTeam/atomics/T1222.002	Path of the file or folder

Attack command

chmod #{symbolic_mode} #{file_or_folder}

GUID6dcec12d-d5d7-490a-adb2-725d6cccaa0a

03 chmod - Change file or folder mode (numeric mode) recursively linux, macos sh — — —

Changes a file or folder's permissions recursively using chmod and a specified numeric mode.

Input arguments

Name	Type	Default	Description
numeric_mode	integer	755	Specified numeric mode value
file_or_folder	path	/tmp/AtomicRedTeam/atomics/T1222.002	Path of the file or folder

Attack command

chmod -R #{numeric_mode} #{file_or_folder}

GUID4b68bc7a-77dd-49fb-b014-7d0386297184

04 chmod - Change file or folder mode (symbolic mode) recursively linux, macos bash — — —

Changes a file or folder's permissions recursively using chmod and a specified symbolic mode.

Input arguments

Name	Type	Default	Description
symbolic_mode	string	a+w	Specified symbolic mode value
file_or_folder	path	/tmp/AtomicRedTeam/atomics/T1222.002	Path of the file or folder

Attack command

chmod -R #{symbolic_mode} #{file_or_folder}

GUIDdba3d111-b78f-4806-ab01-58f1ff983db4

05 chown - Change file or folder ownership and group macos, linux bash — — —

Changes a file or folder's ownership and group information using chown.

Input arguments

Name	Type	Default	Description
group	string	root	Group name of desired group
owner	string	root	Username of desired owner
file_or_folder	path	/tmp/AtomicRedTeam/atomics/T1222.002/T1222.002.yaml	Path of the file or folder

Attack command

chown #{owner}:#{group} #{file_or_folder}

GUIDcc016239-a957-4a40-ae35-8532f5959f49

06 chown - Change file or folder ownership and group recursively macos, linux bash — — —

Changes a file or folder's ownership and group information recursively using chown.

Input arguments

Name	Type	Default	Description
group	string	root	Group name of desired group
owner	string	root	Username of desired owner
file_or_folder	path	/tmp/AtomicRedTeam/atomics/T1222.002	Path of the file or folder

Attack command

chown -R #{owner}:#{group} #{file_or_folder}

GUID3020633b-6d25-4f97-95fa-a6bef9d2105c

07 chown - Change file or folder mode ownership only linux, macos sh — — —

Changes a file or folder's ownership only using chown.

Input arguments

Name	Type	Default	Description
owner	string	root	Username of desired owner
file_or_folder	path	/tmp/AtomicRedTeam/atomics/T1222.002/T1222.002.yaml	Path of the file or folder

Attack command

chown #{owner} #{file_or_folder}

GUID26a913c2-7bd7-4cd6-a175-ae420a0fd873

08 chown - Change file or folder ownership recursively macos, linux bash — — —

Changes a file or folder's ownership only recursively using chown.

Input arguments

Name	Type	Default	Description
owner	string	root	Username of desired owner
file_or_folder	path	/tmp/AtomicRedTeam/atomics/T1222.002	Path of the file or folder

Attack command

chown -R #{owner} #{file_or_folder}

GUID4ea04ce6-2fc6-4a17-b0a0-df290115924b

09 chattr - Remove immutable file attribute macos, linux sh — — —

Remove's a file's immutable attribute using chattr. This technique was used by the threat actor Rocke during the compromise of Linux web servers.

Input arguments

Name	Type	Default	Description
file_to_modify	path	/var/spool/cron/root	Path of the file

Attack command

chattr -i #{file_to_modify}

GUID9994ec2f-e050-482d-bd02-9c51044e4fb7

10 chflags - Remove immutable file attribute linux sh — — —

Remove's a file's immutable attribute using chflags. This technique was used by the threat actor Rocke during the compromise of Linux web servers.

Input arguments

Name	Type	Default	Description
file_to_modify	path	/tmp/T1222.002.txt	Path of the file

Attack command

touch #{file_to_modify}
chflags simmutable #{file_to_modify}
chflags nosimmutable #{file_to_modify}

GUID653731e7-8fd0-4b47-9e76-81679c6c8f34

11 Chmod through c script macos, linux sh — 1 —

chmods a file using a c script

Input arguments

Name	Type	Default	Description
source_file	path	PathToAtomicsFolder/T1222.002/src/T1222.002.c	Path of c source file
compiled_file	path	/tmp/T1222002	Path of compiled file

Attack command

#{compiled_file} /tmp/ T1222002

Prerequisite

Compile the script from (#{source_file}). Destination is #{compiled_file}

Check

gcc #{source_file} -o #{compiled_file}

Satisfy

gcc #{source_file} -o #{compiled_file}

GUID00119c91-71bb-4ca8-ab1e-9a80c3d8d450

12 Chmod through c script (freebsd) linux sh — 1 —

chmods a file using a c script

Input arguments

Name	Type	Default	Description
source_file	path	PathToAtomicsFolder/T1222.002/src/T1222.002.c	Path of c source file
compiled_file	path	/tmp/T1222002	Path of compiled file

Attack command

#{compiled_file} /tmp/ T1222002

Prerequisite

Compile the script from (#{source_file}). Destination is #{compiled_file}

Check

cc #{source_file} -o #{compiled_file}

Satisfy

cc #{source_file} -o #{compiled_file}

GUIDf7731278-df46-4062-950e-22eef51c7aab

13 Chown through c script macos, linux sh Required 1 —

chowns a file to root using a c script

Input arguments

Name	Type	Default	Description
source_file	path	PathToAtomicsFolder/T1222.002/src/chown.c	Path of c source file
compiled_file	path	/tmp/T1222002own	Path of compiled file

Attack command

sudo #{compiled_file} #{source_file}

Prerequisite

Compile the script from (#{source_file}). Destination is #{compiled_file}

Check

gcc #{source_file} -o #{compiled_file}

Satisfy

gcc #{source_file} -o #{compiled_file}

GUID9d424246-0105-4694-b500-e1ecca8e870a

14 Chown through c script (freebsd) linux sh Required 1 —

chowns a file to root using a c script

Input arguments

Name	Type	Default	Description
source_file	path	PathToAtomicsFolder/T1222.002/src/chown.c	Path of c source file
compiled_file	path	/tmp/T1222002own	Path of compiled file

Attack command

#{compiled_file} #{source_file}

Prerequisite

Compile the script from (#{source_file}). Destination is #{compiled_file}

Check

cc #{source_file} -o #{compiled_file}

Satisfy

cc #{source_file} -o #{compiled_file}

GUID74c97ecc-74a7-486e-8eca-bedad9dd71fd

Tests from Atomic Red Team (MIT licence) · technique definition

Linux and Mac Permissions detections T1222.002

8 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

71st pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs