PowerShell Set-Acl on Windows System Folders

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects PowerShell scripts attempting to modify Access Control Lists (ACLs) on files or directories within the Windows system folders. This activity can be indicative of an adversary trying to elevate privileges, establish persistence, or evade defenses by modifying critical system file permissions.