Skip to content

Hide Navigation Hide TOC

Use Icacls to Hide File to Everyone (4ae81040-fc1c-4249-bfa3-938d260214d9)

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Cluster A Galaxy A Cluster B Galaxy B Level
Hidden Files and Directories - T1564.001 (ec8fc7e2-b356-455c-8db5-2e37be158e7d) Attack Pattern Use Icacls to Hide File to Everyone (4ae81040-fc1c-4249-bfa3-938d260214d9) Sigma-Rules 1
Hidden Files and Directories - T1564.001 (ec8fc7e2-b356-455c-8db5-2e37be158e7d) Attack Pattern Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern 2