PowerShell Set-Acl On Windows Folder - PsScript

Title: PowerShell Set-Acl On Windows Folder - PsScript
Status: test
Description:Detects PowerShell scripts to set the ACL to a file in the Windows folder
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md
  -https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-18
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1222'

Logsource:

• product: windows
• category: ps_script
• definition: bade5735-5ab0-4aa7-a642-a11be0e40872

Detection:
  selection_cmdlet:
    ScriptBlockText|contains|all:
      -'Set-Acl '
      -'-AclObject '

  selection_paths:
    ScriptBlockText|contains:
      -'-Path "C:\Windows'
      -'-Path "C:/Windows'
      -'-Path 'C:\Windows'
      -'-Path 'C:/Windows'
      -'-Path C:\\Windows'
      -'-Path C:/Windows'
      -'-Path $env:windir'
      -'-Path "$env:windir'
      -'-Path '$env:windir'

  selection_permissions:
    ScriptBlockText|contains:
      -'FullControl'
      -'Allow'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high