Windows Permissions
Subtechnique · ATTACK:enterprise:T1222.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1222.001",
"title": "Windows Permissions",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1222/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--34e793de-0274-4982-9c1a-246ed1c19dee",
"external_id": "T1222.001",
"domain": "enterprise",
"created": "2020-02-04T19:17:41.767Z",
"modified": "2026-09-11T19:58:37.542Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"defense-impairment"
],
"source_references": [
{
"source_name": "Hybrid Analysis Icacls1 June 2018",
"url": "https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100"
},
{
"source_name": "Hybrid Analysis Icacls2 May 2018",
"url": "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110"
},
{
"source_name": "Microsoft Access Control Lists May 2018",
"url": "https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists"
},
{
"source_name": "Microsoft DACL May 2018",
"url": "https://docs.microsoft.com/windows/desktop/secauthz/dacls-and-aces"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--093f8796-b394-490b-8048-115f4ee32959
Microsoft PLATINUM April 2016ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0cf9ba59-b44a-4266-918f-c493f1485a76
CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a7a152f-79c9-45c9-9f09-0d39f563ad05
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--376c4c97-bec7-455d-ac44-88b7cbd8bd43
ATTACK:enterprise:S9002 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3caf9666-36fe-4e6b-b44b-f87923218f37
Microsoft_diskpart_Feb2023ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3dbc782c-2030-4b32-9bf7-36c65bc9e749
Crowdstrike Indrik November 2018ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47266bcb-b16a-4d95-9c10-bfc48b2f5a8b
ESET Grandoreiro April 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e3b7cf3-298e-4db2-a920-375abd50280d
Sophos New Ryuk Attack October 2020ATTACK:enterprise:T1222.001 → subtechnique-of → ATTACK:enterprise:T1222
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--731fb0bf-242f-43d3-906e-cb5d9781eb7f
ATTACK:enterprise:S0693 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79fb0138-8963-4951-a778-fc9b90150851
Cisco CaddyWiper March 2022ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--851b5150-ad44-4af5-915a-845b3239168d
ANSSI RYUK RANSOMWAREATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3fc552f-e16d-4db7-8bca-d1c273b401f9
Microsoft BlackCat Jun 2022ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c49a3d89-c8fa-4c5d-813e-f4495d892d1a
LogRhythm WannaCryATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4f36a8a-6118-4486-8298-54e5b01b76d5
Trustwave BlackByte 2021ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cae47584-546f-4d3a-9aef-18775b8c8064
QuorumCyber_Vidar_March2023ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9cd867a-074c-4fca-8184-e6adad66af0f
NCC Group WastedLocker June 2020ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1222.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f661d83b-ef6a-4825-bfd5-77138ff4700b
rapid7-email-bombing