attack.t1222.001

AD Object WriteDAC Access

Aug 12, 2024 · attack.defense-evasion attack.t1222.001 ·

Detects WRITE_DAC access to a domain object

Suspicious Recursive Takeown

Aug 12, 2024 · attack.defense-evasion attack.t1222.001 ·

Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders

WannaCry Ransomware Activity

Aug 12, 2024 · attack.lateral-movement attack.t1210 attack.discovery attack.t1083 attack.defense-evasion attack.t1222.001 attack.impact attack.t1486 attack.t1490 detection.emerging-threats ·

Share on:

Detects WannaCry ransomware activity