Icacls Used to Deny Access for Everyone to Hide Files

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the use of `icacls.exe` with specific command-line arguments to deny access for everyone (represented by the SID *S-1-1-0*) to a file or directory. This technique is often used by adversaries to hide malicious files by making them inaccessible to users and potentially some security tools.