ICACLS Grant Command Execution

The analytic detects the use of `icacls.exe`, `cacls.exe`, or `xcacls.exe` with the `/grant` argument to modify file or directory permissions. This activity is often used by adversaries, including APTs and coinminer scripts, to establish persistence, evade detection, and maintain control over compromised systems. Granting additional access can lead to unauthorized access, data exfiltration, or further system compromise.