DRAYN ICACLS ACL Removal on MspPlatform PME Archives Directory
Detects the use of the 'icacls.exe' utility to remove permissions (specifically the 'Everyone' group 'S-1-1-0') from directories related to 'MspPlatform', 'PME', and 'archives'. This behavior is characteristic of an attempt to prevent access to specific files or directories, potentially to hide malicious activities or hinder security analysis.
Splunk (SPL)
