Windows File and Directory Permissions Remove Inheritance

This analytic detects the removal of permission inheritance using ICACLS, CACLS, or XCACLS. It identifies instances where these utilities are used with the `/inheritance:r` flag, which strips inherited permissions while optionally preserving or altering explicit permissions. Removing inheritance can be a legitimate administrative action but may also indicate an attempt to conceal malicious activity or bypass inherited security controls.