Windows DACL Modified to Hide Malicious File

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects network traffic on port 445 (SMB) containing the string "SetFileSecurity" (case-insensitive). This string is associated with modifying file security descriptors, specifically Discretionary Access Control Lists (DACLs), which can be used by attackers to hide malicious files or achieve persistence by altering permissions.