Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionlowtest

PowerShell Script Change Permission Via Set-Acl - PsScript

Detects PowerShell scripts set ACL to of a file or a folder

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François Hubaut, Nasreddine Bencherchali (Nextron Systems)Created Tue Jul 18cae80281-ef23-44c5-873b-fd48d2666f49windows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script

Definition

bade5735-5ab0-4aa7-a642-a11be0e40872

Detection Logic
Detection Logic1 selector
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'Set-Acl '
            - '-AclObject '
            - '-Path '
    condition: selection
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
github.com
MITRE ATT&CK

Other

attack.t1222
Related Rules
DerivedDetectionhigh

PowerShell Set-Acl On Windows Folder

Detects PowerShell scripts to set the ACL to a file in the Windows folder

This rule was derived from the related rule - both detect similar activity with different scope.

DerivedDetectionhigh

PowerShell Script Change Permission Via Set-Acl

Detects PowerShell execution to set the ACL of a file or a folder

This rule was derived from the related rule - both detect similar activity with different scope.

DerivedDetectionhigh

PowerShell Set-Acl On Windows Folder - PsScript

Detects PowerShell scripts to set the ACL to a file in the Windows folder

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
cae80281-ef23-44c5-873b-fd48d2666f49
Status
test
Level
low
Type
Detection
Created
Tue Jul 18
Author
François Hubaut, Nasreddine Bencherchali (Nextron Systems)
Path
rules/windows/powershell/powershell_script/posh_ps_set_acl.yml
Raw Tags
attack.defense-evasionattack.t1222
View on GitHub