Service Binary File Permission Weakness Exploited
This rule detects network traffic on TCP port 445 (SMB) containing the strings "icacls" and "grant" (case-insensitive). This combination suggests an attempt to modify file or directory permissions, specifically granting permissions, which could be indicative of an attacker exploiting a service binary file permission weakness to establish persistence or elevate privileges. The rule is triggered when these strings are observed in traffic flowing to the server.
Suricata
