T1222 — File and Directory Permissions Modification

# T1222 - File and Directory Permissions Modification

## SOC Recommendation
Investigate File and Directory Permissions Modification activity in the context of Defense Impairment: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Restore Configuration | Restore | Use Restore Configuration to recover affected systems or data after containment. |
| Configuration Inventory | Model | Use Configuration Inventory to establish a baseline that makes this technique's deviations easier to spot. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
let accessPolicyTypes = dynamic(["Access Policy", "Artifact Reference"]);
let monitoredActions = dynamic(["Create", "Change", "Delete"]);
SAPBTPAuditLog_CL
| where Category == "audit.security-events"
| extend data_s = tostring(Message.data),
         ipAddress = tostring(Message.ip)
| extend parsedData = parse_json(data_s)
| extend action = tostring(parsedData.action),
         objectType = tostring(parsedData.objectType),
         objectId = tostring(parsedData.objectId),
         policyMessage = tostring(parsedData.attributes.message)
| where objectType in (accessPolicyTypes)
| where action in (monitoredActions)
| extend normalizedAction = case(
    action == "Create", "created",
    action == "Change", "modified",
    action == "Delete", "deleted",
    action
)
| extend MessageText = case(
    objectType == "Access Policy", strcat("Access policy '", objectId, "' was ", normalizedAction),
    objectType == "Artifact Reference", strcat("Artifact reference '", objectId, "' was ", normalizedAction),
    strcat(objectType, " '", objectId, "' was ", normalizedAction)
)
| project
    UpdatedOn,
    UserName,
    MessageText,
    ObjectType = objectType,
    ObjectId = objectId,
    Action = action,
    PolicyMessage = policyMessage,
    Tenant,
    ipAddress,
    CloudApp = "SAP Cloud Integration"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]
```

## Escalation Criteria
- File and Directory Permissions Modification activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1222.json
• /api/recommendations/T1222.json
• /api/d3fend/T1222.json
• /api/mappings/T1222.json
• /api/confluence/T1222.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1222.json

Response:

{
  "technique_id": "T1222",
  "name": "File and Directory Permissions Modification",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Defense Impairment"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files. File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.)...",
  "soc_recommendation": "Investigate File and Directory Permissions Modification activity in the context of Defense Impairment: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-RC",
      "name": "Restore Configuration",
      "relationship": "restore",
      "practical_action": "Use Restore Configuration to recover affected systems or data after containment.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-CI",
      "name": "Configuration Inventory",
      "relationship": "model",
      "practical_action": "Use Configuration Inventory to establish a baseline that makes this technique's deviations easier to spot.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed file and directory permissions modification activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"BTP - Cloud Integration access policy tampering\" -- Identifies changes to access policies in SAP Cloud Integration. Access policies control authorization for integration artifacts, defining which users and roles can access specific integration flows and related content. Unauthorized access policy manipulation could indicate: - Attacker granting themselves access to sensitive integration artifacts - Removal of security controls to enable further malicious activity - Defense evasion by modifying artifact references to hide unauthorized access"
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "9e6f4b2c-0d3e-5a8f-c9b7-2f5d8a1e4c6b — BTP - Cloud Integration access policy tampering",
        "description": "Identifies changes to access policies in SAP Cloud Integration. Access policies control authorization for integration artifacts, defining which users and roles can access specific integration flows and related content. Unauthorized access policy manipulation could indicate: - Attacker granting themselves access to sensitive integration artifacts - Removal of security controls to enable further malicious activity - Defense evasion by modifying artifact references to hide unauthorized access (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let accessPolicyTypes = dynamic([\"Access Policy\", \"Artifact Reference\"]);\nlet monitoredActions = dynamic([\"Create\", \"Change\", \"Delete\"]);\nSAPBTPAuditLog_CL\n| where Category == \"audit.security-events\"\n| extend data_s = tostring(Message.data),\n         ipAddress = tostring(Message.ip)\n| extend parsedData = parse_json(data_s)\n| extend action = tostring(parsedData.action),\n         objectType = tostring(parsedData.objectType),\n         objectId = tostring(parsedData.objectId),\n         policyMessage = tostring(parsedData.attributes.message)\n| where objectType in (accessPolicyTypes)\n| where action in (monitoredActions)\n| extend normalizedAction = case(\n    action == \"Create\", \"created\",\n    action == \"Change\", \"modified\",\n    action == \"Delete\", \"deleted\",\n    action\n)\n| extend MessageText = case(\n    objectType == \"Access Policy\", strcat(\"Access policy '\", objectId, \"' was \", normalizedAction),\n    objectType == \"Artifact Reference\", strcat(\"Artifact reference '\", objectId, \"' was \", normalizedAction),\n    strcat(objectType, \" '\", objectId, \"' was \", normalizedAction)\n)\n| project\n    UpdatedOn,\n    UserName,\n    MessageText,\n    ObjectType = objectType,\n    ObjectId = objectId,\n    Action = action,\n    PolicyMessage = policyMessage,\n    Tenant,\n    ipAddress,\n    CloudApp = \"SAP Cloud Integration\"\n| extend AccountName = split(UserName, \"@\")[0], UPNSuffix = split(UserName, \"@\")[1]"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "968ccab9-da51-4a87-9ce2-d3c9782fd759 — File made Immutable by Chattr",
        "description": "(EQL) Detects a file being made immutable using the chattr binary. Making a file immutable means it cannot be deleted or renamed, no link can be created to this file, most of the file's metadata can not be modified, and the file can not be opened in write mode... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nevent.action in (\"exec\", \"exec_event\", \"start\", \"ProcessRollup2\", \"executed\", \"process_started\") and\n?process.parent.executable != null and\nprocess.name == \"chattr\" and process.args : (\"-*i*\", \"+*i*\") and\nnot (\n  ?process.parent.executable: (\n    \"/lib/systemd/systemd\", \"/usr/local/uems_agent/bin/*\", \"/usr/lib/systemd/systemd\", \"/usr/local/emps/sbin/php-fpm\",\n    \"/usr/local/emps/bin/php\"\n  ) or\n  ?process.parent.name in (\n    \"systemd\", \"cf-agent\", \"ntpdate\", \"xargs\", \"px\", \"preinst\", \"auth\", \"cf-agent\", \"dcservice\", \"dcagentupgrader\",\n    \"sudo\", \"ephemeral-disk-warning\"\n  ) or\n  process.args like \"/opt/ai-bolit/*\"\n)"
      },
      {
        "name": "94418745-529f-4259-8d25-a713a6feb6ae — Executable Bit Set for Potential Persistence Script",
        "description": "(EQL) This rule monitors for the addition of an executable bit for scripts that are located in directories which are commonly abused for persistence. An alert of this rule is an indicator that a persistence mechanism is being set up within your environment. Adversaries may create these scripts to execute malicious code at start-up, or at a set interval to gain persistence onto the system. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"exec\", \"exec_event\", \"start\") and\nprocess.args : (\n  // Misc.\n  \"/etc/rc.local\", \"/etc/rc.common\", \"/etc/rc.d/rc.local\", \"/etc/init.d/*\", \"/etc/update-motd.d/*\",\n  \"/etc/apt/apt.conf.d/*\", \"/etc/cron*\", \"/etc/init/*\", \"/etc/NetworkManager/dispatcher.d/*\",\n  \"/lib/dracut/modules.d/*\", \"/usr/lib/dracut/modules.d/*\",\n\n  // XDG\n  \"/etc/xdg/autostart/*\", \"/home/*/.config/autostart/*\", \"/root/.config/autostart/*\",\n  \"/home/*/.local/share/autostart/*\", \"/root/.local/share/autostart/*\", \"/home/*/.config/autostart-scripts/*\",\n  \"/root/.config/autostart-scripts/*\", \"/etc/xdg/autostart/*\", \"/usr/share/autostart/*\",\n\n  // udev\n  \"/lib/udev/*\", \"/etc/udev/rules.d/*\", \"/usr/lib/udev/rules.d/*\", \"/run/udev/rules.d/*\"\n\n) and (\n  (process.name == \"chmod\" and process.args : (\"+x*\", \"1*\", \"3*\", \"5*\", \"7*\")) or\n  (process.name == \"install\" and process.args : \"-m*\" and process.args : (\"7*\", \"5*\", \"3*\", \"1*\"))\n) and not (\n  process.parent.executable : \"/var/lib/dpkg/*\" or\n  process.command_line in (\"chmod 777 /etc/update-motd.d/\", \"chmod 755 /etc/update-motd.d/\")\n)"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "File and Directory Permissions Modification activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1222 - File and Directory Permissions Modification Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}