T1222.002: Linux and Mac Permissions
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.[1][2] File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Most Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: chown (short for change owner), and chmod (short for change mode).
Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Unix Shell Configuration Modification or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.[3]
Security context for executives and security teams
Linux and macOS file permissions are a control boundary. When an adversary changes ownership or modes on files and directories, the business issue is not just a Unix command being run; it may indicate an attempt to bypass access controls, deny legitimate users access, or prepare other activity such as persistence or execution-flow hijacking. This matters most on systems that host sensitive data, administrative tooling, application configurations, or shared operational services.
Executive priority
Prioritize this technique where Linux or macOS systems support critical services, developer environments, administrative workstations, or internet-facing applications. Leaders should ask whether privileged account use is accountable, whether sensitive file paths have approved permission baselines, and whether the SOC can prove when ownership or mode changes occurred. This is also useful compliance evidence: least privilege and file integrity controls are only defensible if changes to protected files are logged and reviewed.
Technical view
ATT&CK maps this sub-technique to defense impairment on Linux and macOS. The key behaviors are file or directory ownership and permission changes, commonly through chmod and chown, that alter read, write, or execute access. Because MITRE provides no official detection text for this object, defenders should validate coverage through the related DET0351 behavioral chain strategy and local telemetry: command execution, file metadata changes, privileged-account activity, and changes to sensitive configuration, shell, binary, or application directories. Relationship context also links this behavior to Unix shell configuration modification and hijack execution flow, so permission changes should be correlated with persistence- and execution-related file paths rather than treated as isolated events.
Likely telemetry
- Process execution records for chmod, chown, and related shell activity on Linux and macOS
- File system metadata showing ownership, mode, ACL, read/write/execute, or attribute changes
- Privileged account usage logs, including root or administrative context where available
- Endpoint or host audit logs that capture file permission changes on protected paths
- File integrity monitoring or baseline drift data for sensitive binaries, configuration files, shell startup files, application directories, and service locations
Detection direction
- Start by identifying high-value paths where permission changes are unusual or security-relevant, then tune detections around changes to ownership or write/execute permissions.
- Correlate chmod/chown activity with the initiating user, parent process, privilege level, target path, and nearby persistence or execution-flow events.
- Reduce false positives by accounting for expected software installation, patching, deployment, backup, and administrative maintenance windows.
- Treat permission changes by service accounts, scripts, or privileged users as review-worthy when they affect protected files or broaden access beyond the expected owner/group model.
- Validate whether the related DET0351 strategy is implemented in practice; MITRE does not provide detection logic in the technique object itself.
Mitigation priorities
- Establish least-privilege file and directory permission baselines for sensitive Linux and macOS paths.
- Restrict unnecessary write permissions and ensure ownership of protected files and directories is intentional and documented.
- Apply privileged account management so root or administrative permission changes are limited, monitored, and attributable.
- Review and harden permissions around shell configuration files, binaries, application configuration, and other locations that could support persistence or execution hijacking.
- Use baseline review or file integrity processes to identify unauthorized drift from approved permissions.
Additional notes and limits
This object is a Linux/macOS sub-technique of File and Directory Permissions Modification. ATT&CK relationship context includes mitigations M1022 Restrict File and Directory Permissions and M1026 Privileged Account Management, plus a related behavioral detection strategy, DET0351. Several groups, campaigns, and software entries are mapped as using the technique, including macOS and Linux malware examples, but those relationships should be used for detection context rather than assumptions about current exposure or attribution.
MITRE does not provide official detection guidance for this object, so detection recommendations must be validated against local logging depth, endpoint coverage, and approved administrative workflows. The supplied platform scope is Linux and macOS; any cloud, container, network-device, or broader infrastructure interpretation should be limited to environments where those systems expose Unix-like file permissions and where local telemetry confirms visibility.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Linux and Mac Permissions
Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.[1][2] File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Most Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: chown (short for change owner), and chmod (short for change mode).
Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Unix Shell Configuration Modification or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.[3]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1222 | File and Directory Permissions Modification | This object subtechnique of File and Directory Permissions Modification. |
Groups, software, and campaigns
G0139: TeamTNT
TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.[1][2][3][4][5][6][7][8][9]
G0106: Rocke
Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.[1]
G0050: APT32
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]
S0352: OSX_OCEANLOTUS.D
OSX_OCEANLOTUS.D is a macOS backdoor used by APT32. First discovered in 2015, APT32 has continued to make improvements using a plugin architecture to extend capabilities, specifically using `.dylib` files. OSX_OCEANLOTUS.D can also determine it's permission level and execute according to access type (`root` or `user`).[1][2][3]
S9013: DRYHOOK
S0598: P.A.S. Webshell
P.A.S. Webshell is a publicly available multifunctional PHP webshell in use since at least 2016 that provides remote access and execution on target web servers.[1]
S0599: Kinsing
S0402: OSX/Shlayer
OSX/Shlayer is a Trojan designed to install adware on macOS that was first discovered in 2018.[1][2]
S1105: COATHANGER
COATHANGER is a remote access tool (RAT) targeting FortiGate networking appliances. First used in 2023 in targeted intrusions against military and government entities in the Netherlands along with other victims, COATHANGER was disclosed in early 2024, with a high confidence assessment linking this malware to a state-sponsored entity in the People's Republic of China. COATHANGER is delivered after gaining access to a FortiGate device, with in-the-wild observations linked to exploitation of CVE-2022-42475. The name COATHANGER is based on a unique string in the malware used to encrypt configuration files on disk: “She took his coat and hung it up”.[1]
S1070: Black Basta
Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. Black Basta operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. Black Basta affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the Black Basta RaaS operators could include current or former members of the Conti group.[1][2][3][4][5][6]
S0281: Dok
Dok is a Trojan application disguised as a .zip file that is able to collect user credentials and install a malicious proxy server to redirect a user's network traffic (i.e. Adversary-in-the-Middle).[1][2][3]
S0658: XCSSET
XCSSET is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.[1][2][3]
S0587: Penquin
S0482: Bundlore
C0035: KV Botnet Activity
KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. KV Botnet Activity was used by Volt Typhoon to obfuscate connectivity to victims in multiple critical infrastructure segments, including energy and telecommunication companies and entities based on the US territory of Guam. While the KV Botnet is the most prominent element of this campaign, it overlaps with another botnet cluster referred to as the JDY cluster.[1] This botnet was disrupted by US law enforcement entities in early 2024 after periods of activity from October 2022 through January 2024.[2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 269f0bae8689… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Hybrid Analysis Icacls1 June 2018
Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018.
Open source URL - [2]Hybrid Analysis Icacls2 May 2018
Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018.
Open source URL - [3]20 macOS Common Tools and Techniques
Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Open source URL - [4]Trend Micro TeamTNT
Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.
Open source URL - [5]Cisco Talos Intelligence Group
Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
Open source URL - [6]sentinelone apt32 macOS backdoor 2020
Phil Stokes. (2020, December 2). APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique. Retrieved September 13, 2021.
Open source URL - [7]Google UNC5221 Ivanti January 2025
John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.
Open source URL - [8]Picus Security UNC5221 Ivanti May 2025
Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.
Open source URL - [9]ANSSI Sandworm January 2021
ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.
Open source URL - [10]Aqua Kinsing April 2020
Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.
Open source URL - [11]Carbon Black Shlayer Feb 2019
Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019.
Open source URL - [12]Shlayer jamf gatekeeper bypass 2021
Jaron Bradley. (2021, April 26). Shlayer malware abusing Gatekeeper bypass on macOS. Retrieved September 22, 2021.
Open source URL - [13]NCSC-NL COATHANGER Feb 2024
Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.
Open source URL - [14]Uptycs Black Basta ESXi June 2022
Sharma, S. and Hegde, N. (2022, June 7). Black basta Ransomware Goes Cross-Platform, Now Targets ESXi Systems. Retrieved March 8, 2023.
Open source URL - [15]CheckPoint Dok
Ofer Caspi. (2017, May 4). OSX Malware is Catching Up, and it wants to Read Your HTTPS Traffic. Retrieved October 5, 2021.
Open source URL - [16]Lumen KVBotnet 2023
Black Lotus Labs. (2023, December 13). Routers Roasting On An Open Firewall: The KV-Botnet Investigation. Retrieved June 10, 2024.
Open source URL - [17]Anomali Rocke March 2019
Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
Open source URL - [18]ESET OceanLotus macOS April 2019
Dumont, R.. (2019, April 9). OceanLotus: macOS malware update. Retrieved April 15, 2019.
Open source URL - [19]Leonardo Turla Penquin May 2020
Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.
Open source URL - [20]20 macOS Common Tools and Techniques
Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Open source URL - [21]20 macOS Common Tools and Techniques
Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Open source URL - [22]Hybrid Analysis Icacls1 June 2018
Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018.
Open source URL - [23]Hybrid Analysis Icacls1 June 2018
Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018.
Open source URL - [24]Hybrid Analysis Icacls2 May 2018
Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018.
Open source URL - [25]Hybrid Analysis Icacls2 May 2018
Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018.
Open source URL - [26]mitre-attackT1222.002Open source URL
- [27]mitre-attackT1222.002Open source URL
- [28]mitre-attackT1222.002Open source URL
- [29]Cisco Talos Intelligence Group
Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
Open source URL - [30]Trend Micro TeamTNT
Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.
Open source URL - [31]sentinelone apt32 macOS backdoor 2020
Phil Stokes. (2020, December 2). APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique. Retrieved September 13, 2021.
Open source URL - [32]Google UNC5221 Ivanti January 2025
John Wolfram, Josh Murchie, Matt Lin, Daniel Ainsworth, Robert Wallace, Dimiter Andonov, Dhanesh Kizhakkinan, Jacob Thompson. (2025, January 8). Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. Retrieved April 14, 2026.
Open source URL - [33]Picus Security UNC5221 Ivanti May 2025
Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.
Open source URL - [34]ANSSI Sandworm January 2021
ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.
Open source URL - [35]Aqua Kinsing April 2020
Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.
Open source URL - [36]20 macOS Common Tools and Techniques
Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Open source URL - [37]20 macOS Common Tools and Techniques
Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Open source URL - [38]Carbon Black Shlayer Feb 2019
Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019.
Open source URL - [39]Shlayer jamf gatekeeper bypass 2021
Jaron Bradley. (2021, April 26). Shlayer malware abusing Gatekeeper bypass on macOS. Retrieved September 22, 2021.
Open source URL - [40]NCSC-NL COATHANGER Feb 2024
Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.
Open source URL - [41]Uptycs Black Basta ESXi June 2022
Sharma, S. and Hegde, N. (2022, June 7). Black basta Ransomware Goes Cross-Platform, Now Targets ESXi Systems. Retrieved March 8, 2023.
Open source URL - [42]CheckPoint Dok
Ofer Caspi. (2017, May 4). OSX Malware is Catching Up, and it wants to Read Your HTTPS Traffic. Retrieved October 5, 2021.
Open source URL - [43]Lumen KVBotnet 2023
Black Lotus Labs. (2023, December 13). Routers Roasting On An Open Firewall: The KV-Botnet Investigation. Retrieved June 10, 2024.
Open source URL - [44]20 macOS Common Tools and Techniques
Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Open source URL - [45]20 macOS Common Tools and Techniques
Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Open source URL - [46]Anomali Rocke March 2019
Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
Open source URL - [47]ESET OceanLotus macOS April 2019
Dumont, R.. (2019, April 9). OceanLotus: macOS malware update. Retrieved April 15, 2019.
Open source URL - [48]Leonardo Turla Penquin May 2020
Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.
Open source URL - [49]20 macOS Common Tools and Techniques
Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.