PowerShell Script Change Permission Via Set-Acl - PsScript
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects execution of PowerShell scripts that modify file or folder permissions using the Set-Acl cmdlet with the -AclObject and -Path parameters.
Severity
Attention
Rule journey
Attack chain scenario
Initial Access → Execution → Defense Evasion → Privilege Escalation
Impact
Potential unauthorized modification of file or directory permissions to evade security controls or gain elevated access.
Rule Requirement
Prerequisites
PowerShell Auditing
- Log in to any computer that has the Group Policy Management Console (GPMC) with domain admin credentials.
- Open the Group Policy Management Editor, and go to:
Computer Configuration → Policies → Administrative Templates → Windows Components → Windows PowerShell. - In the right pane, right-click on Turn on Module Logging, then select Enabled.
- In the Options pane, click on Show.
In the Module Names window, enter * to record all modules, and press OK. - Still under Windows PowerShell in the Group Policy Editor, locate Turn on PowerShell Script Block Logging in the right pane.
Right-click it and select Enabled. - Create a new registry key named:
"Microsoft-Windows-Powershell/Operational"
in the directory:
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND SCRIPTEXECUTED contains "Set-Acl " AND SCRIPTEXECUTED contains "-AclObject " AND SCRIPTEXECUTED contains "-Path " select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
T1222: File and Directory Permissions Modification
Security Standards
- Privileged account management to restrict permission changes
- Restriction of file and directory permissions to limit unauthorized modifications
- Enable PowerShell script block and module logging for monitoring
Author
frack113, Nasreddine Bencherchali (Nextron Systems)
Future actions
Known False Positives
Unknown
Next Steps
- Investigate PowerShell scripts that modify ACLs for suspicious or unauthorized behavior
- Enforce restrictive permissions on critical files and folders
- Strengthen logging and monitoring of PowerShell execution activities
- Educate administrators and users on secure permission management practices
Mitigation
Mitigation ID | Name | Description |
M1026 | Privileged Account Management | Ensure that critical system files and those prone to adversary modification have restrictive permissions and ownership by privileged accounts. |
M1022 | Restrict File and Directory Permissions | Apply restrictive permissions to files and directories to prevent unauthorized modification of access control lists (ACLs). Disable unnecessary symbolic links. |
M1017 | User Training | Train users and administrators on secure permission management and the importance of preserving ACL integrity. |
M1051 | Update Software | Keep systems updated to patch vulnerabilities that could allow permission escalation via scripts. |
M1038 | Execution Prevention | Use application control policies to restrict execution of unauthorized PowerShell scripts and commands such as Set-Acl. |
M1023 | Logging and Monitoring | Enable PowerShell module logging and script block logging to monitor changes to ACLs and detect suspicious usage of Set-Acl commands. |
