DRAYN icacls ACL Removal on MspPlatform PME Archives Directory

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects the use of the 'icacls.exe' utility to remove permissions (specifically group permissions via '/remove:g') from files or directories containing 'MspPlatform' and 'archives' in the path. This pattern is often associated with unauthorized attempts to modify file access controls to bypass security restrictions or hide data.