PowerShell Script Change Permission Via Set-Acl - PsScript

Title: PowerShell Script Change Permission Via Set-Acl - PsScript
Status: test
Description:Detects PowerShell scripts set ACL to of a file or a folder
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-18
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1222'

Logsource:

• product: windows
• category: ps_script
• definition: bade5735-5ab0-4aa7-a642-a11be0e40872

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'Set-Acl '
      -'-AclObject '
      -'-Path '

  condition:selection
Falsepositives:
  -Unknown
Level: low