Detectionmediumtest

Use Icacls to Hide File to Everyone

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Mon Jul 18Updated Mon Apr 294ae81040-fc1c-4249-bfa3-938d260214d9windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_icacls:
        - OriginalFileName: 'iCACLS.EXE'
        - Image|endswith: '\icacls.exe'
    selection_cmd: # icacls "C:\Users\admin\AppData\Local\37f92fe8-bcf0-4ee0-b8ba-561f797f5696" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        CommandLine|contains|all:
            - '/deny'
            - '*S-1-1-0:'
    condition: all of selection_*