PowerShell Script Modifying File/Folder Permissions via Set-Acl

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•55

Detects PowerShell scripts that modify the Access Control List (ACL) of a file or folder using the `Set-Acl` cmdlet. This activity can be indicative of an adversary attempting to change permissions to gain unauthorized access, elevate privileges, or maintain persistence.