Description
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Most Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: chown (short for change owner), and chmod (short for change mode).
Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Unix Shell Configuration Modification or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.(Citation: 20 macOS Common Tools and Techniques)
Platforms
Mitigations (2)
Restrict File and Directory PermissionsM1022
Applying more restrictive permissions to files and directories could prevent adversaries from modifying the access control lists.
Privileged Account ManagementM1026
Ensure critical system files as well as those known to be abused by adversaries have restrictive permissions and are owned by an appropriately privileged account, especially if access is not required by users nor will inhibit system functionality.
Threat Groups (3)
| ID | Group | Context |
|---|---|---|
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has modified the permissions on binaries with <code>chattr</code>.(Citation: Trend Micro TeamTNT)(Cit... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) has changed file permissions of files so they could not be modified.(Citation: Anomali Rocke March 2019... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050)'s macOS backdoor changes the permission of the file it wants to execute to 755.(Citation: ESET OceanLot... |
Associated Software (11)
| ID | Name | Type | Context |
|---|---|---|---|
| S0352 | OSX_OCEANLOTUS.D | Malware | [OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has changed permissions of a second-stage payload to an executable via <code>chmod</code>.... |
| S9013 | DRYHOOK | Malware | [DRYHOOK](https://attack.mitre.org/software/S9013) has the ability to remount the filesystem as “read-write” to make changes and then restores it to “... |
| S0598 | P.A.S. Webshell | Malware | [P.A.S. Webshell](https://attack.mitre.org/software/S0598) has the ability to modify file permissions.(Citation: ANSSI Sandworm January 2021) |
| S0599 | Kinsing | Malware | [Kinsing](https://attack.mitre.org/software/S0599) has used chmod to modify permissions on key files for use.(Citation: Aqua Kinsing April 2020) |
| S0402 | OSX/Shlayer | Malware | [OSX/Shlayer](https://attack.mitre.org/software/S0402) can use the <code>chmod</code> utility to set a file as executable, such as <code>chmod 777</co... |
| S1105 | COATHANGER | Malware | [COATHANGER](https://attack.mitre.org/software/S1105) will set the GID of `httpsd` to 90 when infected.(Citation: NCSC-NL COATHANGER Feb 2024) |
| S1070 | Black Basta | Malware | The [Black Basta](https://attack.mitre.org/software/S1070) binary can use `chmod` to gain full permissions to targeted files.(Citation: Uptycs Black B... |
| S0281 | Dok | Malware | [Dok](https://attack.mitre.org/software/S0281) gives all users execute permissions for the application using the command <code>chmod +x /Users/Shared/... |
| S0658 | XCSSET | Malware | [XCSSET](https://attack.mitre.org/software/S0658) uses the <code>chmod +x</code> command to grant executable permissions to the malicious file.(Citati... |
| S0587 | Penquin | Malware | [Penquin](https://attack.mitre.org/software/S0587) can add the executable flag to a downloaded file.(Citation: Leonardo Turla Penquin May 2020) |
| S0482 | Bundlore | Malware | [Bundlore](https://attack.mitre.org/software/S0482) changes the permissions of a payload using the command <code>chmod -R 755</code>.(Citation: 20 mac... |
References
- Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018.
- Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018.
- Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Frequently Asked Questions
What is T1222.002 (Linux and Mac Permissions)?
T1222.002 is a MITRE ATT&CK technique named 'Linux and Mac Permissions'. It belongs to the Defense Impairment tactic(s). Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis...
How can T1222.002 be detected?
Detection of T1222.002 (Linux and Mac Permissions) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1222.002?
There are 2 documented mitigations for T1222.002. Key mitigations include: Restrict File and Directory Permissions, Privileged Account Management.
Which threat groups use T1222.002?
Known threat groups using T1222.002 include: TeamTNT, Rocke, APT32.