Restrict File and Directory Permissions
Mitigation · ATTACK:enterprise:M1022
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:M1022",
"title": "Restrict File and Directory Permissions",
"type": "Mitigation",
"source_url": "https://attack.mitre.org/mitigations/M1022",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "course-of-action--987988f0-cf86-4680-a875-2f6456ab2448",
"external_id": "M1022",
"domain": "enterprise",
"created": "2019-06-06T20:54:49.964Z",
"modified": "2026-05-12T15:12:00.731Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
]
}Explicit source assertions (63)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--026e7bb0-2037-4bfc-b9ae-98e70530f22a
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1565.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--110e76f2-815d-4eb0-986f-f6a9905ce640
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1037.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--116ba54b-b2b3-4e63-9f5b-c5171dde0863
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16ef64da-7119-42ad-ad73-e8a34a2b6a0f
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1698
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1729fe56-66f8-4ac8-b579-f171c5a8d834
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1037.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27c0f853-f7b0-43e9-b980-7965d1227a9e
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1053.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c6c988d-d843-4dc0-82be-b504e3c3a39c
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1218.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2db67ddf-b414-4dc7-87ab-0846a8bd1e8e
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1685.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e663f51-b8a5-4578-b824-1277f304e1eb
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1547.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--328fdf30-3195-4d15-b99c-bf14cc236a90
Microsoft W32Time May 2017ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1574.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36f7b849-03af-4567-be71-2e1eb1520b2a
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--376c4c97-bec7-455d-ac44-88b7cbd8bd43
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1037.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3884e1f8-c4ee-4337-b24c-1a5d2cecffc5
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1686.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b6649ea-cd97-435e-8257-78e209638300
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bc431bd-f093-4daf-b264-e73f1fcf591a
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1565.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47640cbc-a128-4a78-b02e-d0b073809257
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1552.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47c4478d-1526-4c4f-8158-17ad8cfcc6b9
cisco_deploy_rsa_keysATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1055.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49d40f3b-33b4-424c-a645-82d2a84e5c28
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cc1fe6e-b097-4e81-b0c3-aee729ec9600
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1686
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e4fdef4-b0a4-4899-849e-2e16af6a95f3
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1574.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a70a968-618c-489e-8087-eabca740aa3a
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1547.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5dcc5947-375c-4b73-867b-5beb6e333c69
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1564.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67edd4b3-09f8-47c7-aaf1-6440524c78d4
InsiderThreat NTFS EA Oct 2017ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68146568-bc1f-49b6-9477-c6c06b0fa39c
piazza launch agent mitigationATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1574.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a3e8d7c-fdb3-4249-9f4e-7825e253bbfd
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1546.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b4cb169-cda8-49ef-a8db-188c599f50f1
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1070
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6db4729b-596c-43c1-81f4-d374a2f2e06b
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1098
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fd6a4ce-d14c-48ed-88c5-3997e67e0fd6
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1574
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7253ab74-8fbb-422b-bf37-258981865b87
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72de6e56-e5d1-4a3f-aa85-d7155f7ff42c
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1547.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78aa862c-56a1-477b-b2d0-8d48d1969354
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1222
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79412658-c213-4746-b03d-c828957d6ddb
create_sym_linksATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1053
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a0efacc-7005-4f1e-9fb8-047d8b703cf8
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1563.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b191418-e24b-4db1-98e1-a7ee56b271f6
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1070.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b89b499-2fc7-43cd-990f-297bdd15d2f3
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--800f4061-3347-4816-a633-179ede275505
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1070.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80a7d2d1-863e-43b5-b22d-72696c591206
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1552
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8497e912-185d-403b-865e-17c4b02290d2
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1543.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d7f9d7b-c246-4849-b65e-1ac45208b427
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1070.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e7fc18e-06a3-437f-8e3b-18f5378c9d44
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1543
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e93d680-0e33-4577-97f6-da4e53f8ab78
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1037.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a04579db-cc93-4f62-88f1-c2cdc220ab70
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1685.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a31e7f18-5aac-4657-a115-df6802409800
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1556
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6aad172-c44b-4d21-9bf3-bb9c2dce2f67
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1548
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b12a23ae-65f6-4226-8124-331ad59d1556
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1546.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be36df4d-4180-4271-ae0a-a7677df40261
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1530
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be61f77a-93a3-4699-b134-52b199c7b196
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1574.014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c384718b-90e4-4bd7-ae2e-ff705c40a23a
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1574.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca04cce0-2f47-4c73-956f-808573b62903
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1565
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cafefef9-bf75-48e2-91e4-716988309f52
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1569
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce16e7b4-b78e-4587-bf65-8a0c0c370cc4
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d107e5fd-53fc-478d-9040-85087070d7ff
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1037
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d32467b1-8d30-4134-ac6d-541cb623f8c2
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ddefe661-bfca-47ad-aa9c-3edb0b6f510a
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e28dc4ab-86fe-480e-9f0d-d7fab54c432d
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1048
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5ad94e4-f136-44d7-8000-7dd607538a7c
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec56fe4c-c61c-45e3-82fb-44edd43540fc
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ecf9df35-e4f5-4041-a65d-0e897e5435b0
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1553.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee2fcc2b-735d-4948-b25a-401f60fe7412
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee8e9551-278a-4f96-8179-d9290b95ed99
win_xml_evt_logATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1700
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f41d077c-c8f4-485b-b557-54231e82be7f
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4ac7555-2b20-4345-998e-6ffc462cab03
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1548.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5b14e1c-a5d6-45fb-b329-793e0a2b7ca4