PowerShell Set-Acl on Windows Folder

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects PowerShell scripts attempting to modify Access Control Lists (ACLs) on files or directories within the Windows system folders. This activity is suspicious as it can be used by adversaries to gain persistence, elevate privileges, or evade defenses by modifying critical system file permissions.