Updated after successful CICD run 06/21/2023 13:04:13 UTC

olafhartong · Jun 21, 2023 · 7c69adc · 7c69adc
1 parent d174fe8
commit 7c69adc
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/sysmonconfig-mde-augment.xml b/sysmonconfig-mde-augment.xml
@@ -144,7 +144,7 @@
         <Rule name="File Permissions Modification" groupRelation="or">
           <OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="is">takeown.exe</OriginalFileName>
           <Image name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="image">forfiles.exe</Image>
-          <OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="contains any">icacls.exe;cacls.exe</OriginalFileName>
+          <OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="contains any">icacls.exe;cacls.exe;xcacls.exe</OriginalFileName>
         </Rule>
         <Rule name="Access Token Manipulation" groupRelation="or">
           <OriginalFileName name="technique_id=T1134,technique_name=Access Token Manipulation" condition="is">runas.exe</OriginalFileName>

diff --git a/sysmonconfig.xml b/sysmonconfig.xml
@@ -139,7 +139,7 @@
         <Rule name="File Permissions Modification" groupRelation="or">
           <OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="is">takeown.exe</OriginalFileName>
           <Image name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="image">forfiles.exe</Image>
-          <OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="contains any">icacls.exe;cacls.exe</OriginalFileName>
+          <OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="contains any">icacls.exe;cacls.exe;xcacls.exe</OriginalFileName>
         </Rule>
         <Rule name="Access Token Manipulation" groupRelation="or">
           <OriginalFileName name="technique_id=T1134,technique_name=Access Token Manipulation" condition="is">runas.exe</OriginalFileName>