Use Icacls to Hide File to Everyone

Title: Use Icacls to Hide File to Everyone
Status: test
Description:Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files
References:
  -https://app.any.run/tasks/1df999e6-1cb8-45e3-8b61-499d1b7d5a9b/
Author: frack113
Date: 2022-07-18
modified:2024-04-29
Tags:

• -'attack.stealth'
• -'attack.t1564.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_icacls:
OriginalFileName:'iCACLS.EXE' Image|endswith:'\icacls.exe'   selection_cmd:
    CommandLine|contains|all:
      -'/deny'
      -'*S-1-1-0:'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium