File and Directory Permissions Modification

Technique · ATTACK:enterprise:T1222

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1222",
  "title": "File and Directory Permissions Modification",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1222",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--65917ae0-b854-4139-83fe-bf2441cf0196",
  "external_id": "T1222",
  "domain": "enterprise",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2026-05-12T15:12:00.637Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment"
  ],
  "source_references": [
    {
      "source_name": "falconoverwatch_blackcat_attack",
      "url": "https://www.crowdstrike.com/blog/falcon-overwatch-contributes-to-blackcat-protection/"
    },
    {
      "source_name": "Hybrid Analysis Icacls1 June 2018",
      "url": "https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100"
    },
    {
      "source_name": "Hybrid Analysis Icacls2 May 2018",
      "url": "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110"
    },
    {
      "source_name": "bad_luck_blackcat",
      "url": "https://go.kaspersky.com/rs/802-IJN-240/images/TR_BlackCat_Report.pdf"
    },
    {
      "source_name": "fsutil_behavior",
      "url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior"
    },
    {
      "source_name": "blackmatter_blackcat",
      "url": "https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html"
    },
    {
      "source_name": "new_rust_based_ransomware",
      "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-alphv-rust-ransomware"
    }
  ]
}

Explicit source assertions (5)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.