DRAYN icacls MspPlatform ACL Removal and Stealth Scheduled Task Persistence

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

This rule detects activities associated with the DRAYN malware, specifically the unauthorized modification of Discretionary Access Control Lists (DACLs) on MSP management platform directory archives using icacls, followed by the creation of a scheduled task to establish persistence.