PowerShell Set-Acl for Permission Modification

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects PowerShell execution using the `Set-Acl` cmdlet to modify the Access Control List (ACL) of a file or folder. This can be used by adversaries to change permissions, potentially granting themselves or other users/groups unauthorized access or denying access to legitimate users/services as a form of defense evasion or impact.