attack_technique: T1222.001
display_name: 'File and Directory Permissions Modification: Windows File and Directory Permissions Modification'
atomic_tests:
- name: Take ownership using takeown utility
  auto_generated_guid: 98d34bb4-6e75-42ad-9c41-1dae7dc6a001
  description: |
    Modifies the filesystem permissions of the specified file or folder to take ownership of the object. Upon execution, "SUCCESS" will
    be displayed for the folder and each file inside of it.
  supported_platforms:
  - windows
  input_arguments:
    file_folder_to_own:
      description: Path of the file or folder for takeown to take ownership.
      type: Path
      default: '%temp%\T1222.001_takeown_folder'
  dependency_executor_name: command_prompt
  dependencies:
  - description: |
      Test requrires a file to take ownership of to be located at (#{file_folder_to_own})
    prereq_command: |
      IF EXIST #{file_folder_to_own} ( EXIT 0 ) ELSE ( EXIT 1 )
    get_prereq_command: |
      mkdir #{file_folder_to_own}
      echo T1222.001_takeown1 >> #{file_folder_to_own}\T1222.001_takeown1.txt
      echo T1222.001_takeown2 >> #{file_folder_to_own}\T1222.001_takeown2.txt
  executor:
    command: |
      takeown.exe /f #{file_folder_to_own} /r
    name: command_prompt
- name: cacls - Grant permission to specified user or group recursively
  auto_generated_guid: a8206bcc-f282-40a9-a389-05d9c0263485
  description: |
    Modifies the filesystem permissions of the specified folder and contents to allow the specified user or group Full Control. If "Access is denied"
    is displayed it may be because the file or folder doesn't exit. Run the prereq command to create it. Upon successfull execution, "Successfully processed 3 files"
    will be displayed.
  supported_platforms:
  - windows
  input_arguments:
    file_or_folder:
      description: Path of the file or folder to change permissions.
      type: Path
      default: '%temp%\T1222.001_cacls'
    user_or_group:
      description: User or group to allow full control
      type: String
      default: Everyone
  dependency_executor_name: command_prompt
  dependencies:
  - description: |
      Test requrires a file to modify to be located at (#{file_or_folder})
    prereq_command: |
      IF EXIST #{file_or_folder} ( EXIT 0 ) ELSE ( EXIT 1 )
    get_prereq_command: |
      mkdir #{file_or_folder}
      echo T1222.001_cacls1 >> #{file_or_folder}\T1222.001_cacls1.txt
      echo T1222.001_cacls2 >> #{file_or_folder}\T1222.001_cacls2.txt
  executor:
    command: |
      icacls.exe #{file_or_folder} /grant #{user_or_group}:F
    name: command_prompt
- name: attrib - Remove read-only attribute
  auto_generated_guid: bec1e95c-83aa-492e-ab77-60c71bbd21b0
  description: |
    Removes the read-only attribute from a file or folder using the attrib.exe command. Upon execution, no output will be displayed.
    Open the file in File Explorer > Right Click - Prperties and observe that the Read Only checkbox is empty.
  supported_platforms:
  - windows
  input_arguments:
    file_or_folder:
      description: Path of the file or folder remove attribute.
      type: Path
      default: '%temp%\T1222.001_attrib'
  dependency_executor_name: command_prompt
  dependencies:
  - description: |
      Test requrires a file to modify to be located at (#{file_or_folder})
    prereq_command: |
      IF EXIST #{file_or_folder} ( EXIT 0 ) ELSE ( EXIT 1 )
    get_prereq_command: |
      mkdir #{file_or_folder}
      echo T1222.001_attrib1 >> #{file_or_folder}\T1222.001_attrib1.txt
      echo T1222.001_attrib2 >> #{file_or_folder}\T1222.001_attrib2.txt
      attrib.exe +r #{file_or_folder}\T1222.001_attrib1.txt
      attrib.exe +r #{file_or_folder}\T1222.001_attrib2.txt
  executor:
    command: |
      attrib.exe -r #{file_or_folder}\*.* /s
    name: command_prompt
- name: attrib - hide file
  auto_generated_guid: 32b979da-7b68-42c9-9a99-0e39900fc36c
  description: |
    Attackers leverage an existing Windows binary, attrib.exe, to mark specific files or folder as hidden by using specific flags so that
    the victim does not see the file.
  supported_platforms:
  - windows
  input_arguments:
    file_or_folder:
      description: Path of the files to hide.
      type: Path
      default: '%temp%\T1222.001_attrib_2'
  executor:
    command: |
      mkdir #{file_or_folder} >nul 2>&1
      echo T1222.001_attrib1 >> #{file_or_folder}\T1222.001_attrib1.txt
      echo T1222.001_attrib2 >> #{file_or_folder}\T1222.001_attrib2.txt
      attrib.exe +h #{file_or_folder}\T1222.001_attrib1.txt
      attrib.exe +h #{file_or_folder}\T1222.001_attrib2.txt
    cleanup_command: |
      del /A:H #{file_or_folder}\T1222.001_attrib*.txt >nul 2>&1
    name: command_prompt
- name: 'Grant Full Access to folder for Everyone - Ryuk Ransomware Style'
  auto_generated_guid: ac7e6118-473d-41ec-9ac0-ef4f1d1ed2f6
  description: |
    Invokes the command line similar to that used by Ryuk Ransomware to grant full access to the entire C:\ drive for Everyone.
    **icacls "C:\*" /grant Everyone:F /T /C /Q**
    However, for this atomic we set the permission on C:\Users\Public so it completes faster and doesn't irreversibly affect the host.
    You can set your own path variable to "C:\*" if you prefer.
  supported_platforms:
  - windows
  input_arguments:
    path:
      description: Path of folder to recursively set permissions on
      type: Path
      default: 'C:\Users\Public\*'
    file_path:
      description: Path of folder permission back
      type: Path
      default: '%temp%\T1222.001-folder-perms-backup.txt'
  dependency_executor_name: command_prompt
  dependencies:
  - description: |
      Backup of original folder permissions should exist (for use in cleanup commands)
    prereq_command: |
      IF EXIST #{file_path} ( EXIT 0 ) ELSE ( EXIT 1 )
    get_prereq_command: |
      icacls #{path} /save #{file_path} /t /q >nul 2>&1
  executor:
    command: icacls "#{path}" /grant Everyone:F /T /C /Q
    cleanup_command: |
      icacls '#{path}' /restore #{file_path} /q >nul 2>&1
    name: command_prompt
    elevation_required: true 
