Windows Folder Permission Weakened via Remote Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects network traffic on port 445 (SMB) containing the strings "cacls" and "/G Everyone:F" (case-insensitive). This combination suggests an attempt to weaken folder permissions on a Windows system by granting full control to 'Everyone' using the `cacls` command, potentially via remote registry access or a similar mechanism that transmits the command over the network.