File or Folder Permissions Modifications
Detects modifications to file or folder permissions using common Windows command-line utilities such as cacls, icacls, net, attrib, and takeown. This can indicate an adversary attempting to evade access controls or gain access to protected files.
Sigma
