M1022: Restrict File and Directory Permissions

Use file system access controls to protect folders such as `C:\Windows\System32`.

Ensure least privilege principles are applied to important information resources to reduce exposure to data manipulation risk.

Limit privileges of user accounts so only authorized users can edit the `rc.common` file.

Applying more restrictive permissions to files and directories could prevent adversaries from modifying the access control lists.

Since StartupItems are deprecated, preventing all users from writing to the /Library/StartupItems directory would prevent any startup items from getting registered.

Restrict read/write access to systemd .timer unit files to only select privileged users who have a legitimate need to manage system services.

Restrict storage and execution of Control Panel items to protected directories, such as C:\Windows, rather than user directories.

Consider using Group Policy to configure and block additions/modifications to W32Time DLLs. CitationMicrosoft W32Time May 2017

Set directory access controls to prevent file writes to the search paths for applications, both in the folders where applications are run from and the standard dylib folders.

Applying more restrictive permissions to files and directories could prevent adversaries from modifying the access control lists.

Restrict write access to logon scripts to specific administrators.

Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings.

Restrict access to the authorized_keys file.

Prevent critical business and system processes from being replaced, overwritten, or reconfigured to load potentially malicious code.

Ensure permissions are properly set on folders containing sensitive private keys to prevent unintended access. Additionally, on Cisco devices, set the `nonexportable` flag during RSA key pair generation.Citationcisco_deploy_rsa_keys

Restrict the permissions on sensitive files such as /proc/[pid]/maps or /proc/[pid]/mem.

Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.

Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings.

Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory C: and system directories, such as C:\Windows\, to reduce places where malicious files could be placed for execution. Require that all executables be placed in write-protected directories.

Restrict write access to XDG autostart entries to only select privileged users.

Consider adjusting read and write permissions for NTFS EA, though this should be tested to ensure routine OS operations are not impeded. CitationInsiderThreat NTFS EA Oct 2017

Set group policies to restrict file permissions to the ~/launchagents folder.Citationpiazza launch agent mitigation

Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory C: and system directories, such as C:\Windows\, to reduce places where malicious files could be placed for execution. Require that all executables be placed in write-protected directories.

Making PowerShell profiles immutable and only changeable by certain administrators will limit the ability for adversaries to easily create user level persistence.

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

Restrict access to potentially sensitive files that deal with authentication and/or authorization.

Install software in write-protected locations. Set directory access controls to prevent file writes to the search paths for applications, both in the folders where applications are run from and the standard library folders.

Use file system access controls to protect folders such as C:\\Windows\\System32.

Applying strict permissions to directories where shortcuts are stored, such as the startup folder, can prevent unauthorized modifications.

Applying more restrictive permissions to files and directories could prevent adversaries from modifying their access control lists. Additionally, ensure that user settings regarding local and remote symbolic links are properly set or disabled where unneeded.Citationcreate_sym_links

Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.

Ensure proper file permissions are set and harden system to prevent root privilege escalation opportunities.

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

Restrict file shares to specific directories with access only to necessary users.

Restrict read/write access to systemd unit files to only select privileged users who have a legitimate need to manage system services.

Preventing users from deleting or writing to certain files can stop adversaries from maliciously altering their ~/.bash_history or ConsoleHost_history.txt files.

Restrict read/write access to system-level process files to only select privileged users who have a legitimate need to manage system services.

Restrict write access to logon scripts to specific administrators.

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

Restrict write access to the `/Library/Security/SecurityAgentPlugins` directory.

The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.

Making these files immutable and only changeable by certain administrators will limit the ability for adversaries to easily create user level persistence.

Use access control lists on storage systems and objects.

Install .NET applications and related software in write-protected locations. Set directory access controls to prevent file writes to the search paths for .NET applications, both in the folders where applications are run from and the standard resources folders.

Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory C: and system directories, such as C:\Windows\, to reduce places where malicious files could be placed for execution. Require that all executables be placed in write-protected directories.

Ensure least privilege principles are applied to important information resources to reduce exposure to data manipulation risk.

Ensure that high permission level service binaries cannot be replaced or modified by users with a lower permission level.

Ensure that high permission level service binaries cannot be replaced or modified by users with a lower permission level.

Restrict write access to logon scripts to specific administrators.

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.

Use access control lists on cloud storage systems and objects.

Use file system access controls to protect folders such as `C:\Windows\System32`.

Protect shared folders by minimizing users who have write access.

Restrict storage and execution of SIP DLLs to protected directories, such as C:\\Windows, rather than user directories.

Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with logging or deleting or modifying .evtx logging files. Ensure .evtx files, which are located at C:\Windows\system32\Winevt\LogsCitationwin_xml_evt_log, have the proper file permissions for limited, legitimate access and audit policies for detection.

Restrict file shares to specific directories with access only to necessary users.

When using an MDM, ensure the permissions granted are specific to the requirements of the binary. Full Disk Access should be restricted to only necessary binaries in alignment with policy.