Linux and Mac Permissions
Subtechnique · ATTACK:enterprise:T1222.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1222.002",
"title": "Linux and Mac Permissions",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1222/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--09b130a2-a77e-4af0-a361-f46f9aad1345",
"external_id": "T1222.002",
"domain": "enterprise",
"created": "2020-02-04T19:24:27.774Z",
"modified": "2026-05-12T15:12:00.620Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"defense-impairment"
],
"source_references": [
{
"source_name": "Hybrid Analysis Icacls1 June 2018",
"url": "https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100"
},
{
"source_name": "Hybrid Analysis Icacls2 May 2018",
"url": "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110"
},
{
"source_name": "20 macOS Common Tools and Techniques",
"url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08c69567-a511-4a07-ab5d-a5bf77594129
Cisco Talos Intelligence Group · Trend Micro TeamTNTATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d40b95c-629c-46bf-bafc-2558a180fedc
sentinelone apt32 macOS backdoor 2020ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16ef64da-7119-42ad-ad73-e8a34a2b6a0f
ATTACK:enterprise:T1222.002 → subtechnique-of → ATTACK:enterprise:T1222
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1eb067c7-e741-46b6-9080-dbc8395f8c43
ATTACK:enterprise:S9013 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27f03620-ca7c-4113-be7c-13fe48691b46
Google UNC5221 Ivanti January 2025 · Picus Security UNC5221 Ivanti May 2025ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3062f5f2-8a0d-4a1b-ac64-aa6c3b06a1a5
ANSSI Sandworm January 2021ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4723be88-3553-4c1c-8cd1-8c68b161c1cf
Aqua Kinsing April 2020ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--544cc12a-53c4-4a56-b480-bfc79beee93c
Carbon Black Shlayer Feb 2019 · Shlayer jamf gatekeeper bypass 2021 · 20 macOS Common Tools and TechniquesATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e5ee6b9-182f-47fb-a0b5-71c3c52fed12
ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f357194-57f9-463f-a8f4-6f997d3fc488
NCSC-NL COATHANGER Feb 2024ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8097b8e6-73f2-44f4-9234-dffa4794e0c6
Uptycs Black Basta ESXi June 2022ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cb06251-a974-439f-8c36-a3fc65b7d154
CheckPoint DokATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d2d1a8e-7fa4-4726-aad2-7a21dfbe1c87
Lumen KVBotnet 2023ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9021af47-45ef-4021-a697-d76ccb790f07
20 macOS Common Tools and TechniquesATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2f88508-4177-4294-b287-6a3494f6e738
Anomali Rocke March 2019ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4409632-996c-4f20-bdb0-a8e92c98307f
ESET OceanLotus macOS April 2019ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c270ebd7-56e2-4ede-bd45-57da4a0065f2
Leonardo Turla Penquin May 2020ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f19f6015-ffbe-4998-ad82-403fcfc2e649
20 macOS Common Tools and TechniquesATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1c45a0b-159b-4edd-be97-5441185f90bc
Microsoft Sapphire Sleet APR 2026