MITRE ATT&CK M1022 File and Directory Permissions

A writable service binary, a world-readable key file or a logon script anyone can edit turns an ordinary foothold into persistence, privilege escalation or stolen credentials, and MITRE ATT&CK M1022 Restrict File and Directory Permissions is the mitigation that closes those doors. ATT&CK v20 defines M1022 as setting access controls at the file system level to limit which users, groups or processes can read, write or execute files, and links it to 63 techniques and sub-techniques, more than most mitigations. That breadth is the point: file permissions are the substrate under persistence, hijacking, credential theft and log tampering on Windows, Linux and macOS alike. This guide reads M1022 from the ATT&CK point of view: which techniques it blunts, which files matter most, where it does not help and what covers the gaps, and how to measure it. It is for platform engineers, detection engineers and anyone who owns secrets on disk. Mechanics are covered elsewhere: the Linux File Permissions, SUID and ACLs Guide and the Windows File Server and NTFS Permissions Guide.

Key takeaways

Write access is the main risk. Most of the 63 mappings are about who can write: service binaries, search-path folders, startup items, systemd units, shell profiles and logon scripts. Read access matters for a smaller, high-value set: keys, credential files and secrets.
Three file families give most of the value. Things that run with privilege (services, scheduled tasks, units), things that run at logon (scripts, profiles, startup folders) and things that authenticate (private keys, authorized_keys, credential files).
Non-human identities live in files. Service account keytabs, cloud credential files, .env files and mounted Kubernetes Secrets are protected by file permissions first, which makes M1022 an NHI control.
Permissions do not stop an administrator. An intruder with root or SYSTEM can change any ACL, which is why ATT&CK pairs M1022 with preventing privilege escalation and with monitoring permission changes.
Measure drift, not intent. Report the count of privileged executables and directories writable by non-administrators, and the number of secret files readable by more than their owner, on every build.

What M1022 asks for

The ATT&CK M1022 page lists least-privilege permissions (remove unnecessary write access, use ownership and groups), hardened file shares (no anonymous access, NTFS permissions on shares), file integrity monitoring, auditing of file system access, and restricted startup directories such as C:\ProgramData\Microsoft\Windows\Start Menu. It names /etc/, /usr/local/, /bin, /sbin and C:\Windows\System32 as directories whose write access must be tight. D3FEND relates M1022 to one defensive technique, Local File Permissions (D3-LFP), defined as managing access control policies for files on a local system through operating system configuration.

One caution: changing ACLs on operating system directories such as C:\Windows\System32 in bulk can break updates and servicing, so test on a pilot image and rely on vendor security baselines for system directories. Microsoft's icacls documentation lists /save and /restore for capturing DACLs before changes, which is the rollback you want.

Techniques M1022 mitigates, by tactic

The 63 v20 mappings, grouped and collapsed where ATT&CK gives sub-techniques the same text. "How it helps" paraphrases ATT&CK's per-technique usage text. Priority is an NHI Mgmt Group judgement.

Tactic	Technique (v20)	How M1022 helps, per ATT&CK	Priority
Execution, persistence	T1569 System Services, T1569.002 Service Execution	High-privilege service binaries must not be replaceable or modifiable by lower-privilege users	High
Stealth, execution	T1574 Hijack Execution Flow, T1574.004 Dylib Hijacking, T1574.007 PATH Environment Variable, T1574.008 Search Order Hijacking, T1574.009 Unquoted Path, T1574.014 AppDomainManager	Install software in write-protected locations; deny writes to application folders, library search paths, `C:\` and `C:\Windows\`	High
Persistence, privilege escalation	T1543 Create or Modify System Process, T1543.001 Launch Agent, T1543.002 Systemd Service; T1053 Scheduled Task/Job, T1053.006 Systemd Timers	Restrict read and write on unit files, timer files and launch agent folders to administrators who manage services	High
Persistence, privilege escalation	T1037 Boot or Logon Initialization Scripts, T1037.002 Login Hook, T1037.003 Network Logon Script, T1037.004 RC Scripts, T1037.005 Startup Items	Only specific administrators can write logon scripts, `rc.common` or `/Library/StartupItems`	High
Persistence, privilege escalation	T1546.004 Unix Shell Configuration Modification, T1546.013 PowerShell Profile; T1547.009 Shortcut Modification, T1547.013 XDG Autostart Entries, T1547.003 Time Providers	Make profiles immutable and administrator-only; strict permissions on startup and autostart folders; block changes to W32Time DLLs	Medium
Persistence, privilege escalation	T1098 Account Manipulation, T1098.004 SSH Authorized Keys	Restrict access to authentication files, including `authorized_keys`	High
Privilege escalation	T1548 Abuse Elevation Control Mechanism, T1548.003 Sudo and Sudo Caching, T1548.006 TCC Manipulation	Edit sudoers so passwords are always required and users cannot spawn risky processes; limit Full Disk Access to necessary binaries	High
Credential access	T1552 Unsecured Credentials, T1552.001 Credentials In Files, T1552.004 Private Keys	Restrict shares to necessary users; set folder permissions on private keys; mark Cisco RSA keys non-exportable	High
Defence impairment, persistence, credential access	T1556 Modify Authentication Process	Restrict write access to `/Library/Security/SecurityAgentPlugins`	Medium
Defence impairment	T1222 File and Directory Permissions Modification, T1222.001 Windows, T1222.002 Linux and Mac	Restrictive permissions stop ACLs being modified; disable local and remote symbolic link evaluation where unneeded	Medium
Defence impairment	T1685 Disable or Modify Tools, T1685.001 Windows Event Log, T1685.005 Clear Windows Event Logs, T1685.006 Clear Linux or Mac System Logs; T1686 Disable or Modify System Firewall, T1686.003 Windows Host Firewall	Process and file permissions stop tampering with security services, firewalls and `.evtx` files in `C:\Windows\system32\Winevt\Logs`	High
Defence impairment	T1685.007 Impair Autonomous Defenses	Limit AI-assisted analysis systems to required files; stop artefacts under investigation modifying agent configuration or instruction files	Medium
Defence impairment	T1553.003 SIP and Trust Provider Hijacking; T1218.002 Control Panel	Keep SIP DLLs and Control Panel items in protected directories such as `C:\Windows`	Medium
Stealth	T1036 Masquerading, T1036.003 Rename Legitimate Utilities, T1036.005 Match Legitimate Resource Name or Location; T1564.004 NTFS File Attributes; T1055.009 Proc Memory	Protect `C:\Windows\System32`; consider NTFS extended attribute permissions; restrict `/proc/[pid]/maps` and `/proc/[pid]/mem`	Medium
Stealth	T1070 Indicator Removal, T1070.003 Clear Command History, T1070.008 Clear Mailbox Data, T1070.009 Clear Persistence	Protect locally stored event files and history files such as `~/.bash_history`	Medium
Lateral movement	T1080 Taint Shared Content; T1563.001 SSH Hijacking	Minimise users with write access to shared folders; harden against root escalation	High
Collection, exfiltration	T1530 Data from Cloud Storage; T1048 Exfiltration Over Alternative Protocol	Use access control lists on cloud storage systems and objects	Medium
Execution, exfiltration (AI)	T1698 Indirect Prompt Injection; T1700 AI-Enabled Exfiltration	Restrict AI agents to the files and repositories their workflow needs, with write separated from read	Medium
Impact	T1489 Service Stop; T1565 Data Manipulation, T1565.001 Stored, T1565.003 Runtime	Process and file permissions protect critical services; least privilege on important data and on processes that load code	Medium

Technique guides: T1574 Hijack Execution Flow Defensive Guide, T1543 Create or Modify System Process Defensive Guide, MITRE ATT&CK T1037 Boot or Logon Initialization Scripts, MITRE ATT&CK T1552 Unsecured Credentials Guide, MITRE ATT&CK T1548 Abuse Elevation Control Mechanism and MITRE ATT&CK T1080 Taint Shared Content.

The files that matter most

File family	Windows examples	Linux and macOS examples	Target state
Privileged executables	Service `ImagePath` binaries and their folders, `C:\Program Files`	Binaries in `/usr/local/bin`, binaries run by root cron or systemd	Owned by an administrator or root; no write for users, groups or service accounts that do not install software
Service and job definitions	Scheduled task XML in `C:\Windows\System32\Tasks`	Unit and `.timer` files, `/etc/cron.*`, launch daemons and agents	Root or administrator write only
Logon execution	Startup folders, NETLOGON scripts, PowerShell profiles	`~/.bashrc`, `/etc/profile.d`, XDG autostart, `rc.common`	Administrator write for system-wide files; user files monitored
Authentication material	Machine certificate private keys, credential files on shares	`authorized_keys`, private SSH keys, Kerberos keytabs, `sudoers`	Owner read only (for example mode 0600 or 0400); no group or world access
Application secrets	Config files with connection strings, unattended install files	`.env` files, cloud CLI credential files, mounted Kubernetes Secrets	Readable only by the workload identity; never inside a web root
Logs and evidence	`.evtx` files in `Winevt\Logs`	`/var/log`, shell history	Append or system write only; forwarded off host

Where identity fits: secrets and keys on disk

For non-human identities, the file is often the credential. Three patterns repay attention.

Secrets in the web root: the 230 Million AWS Cloud Environments Campaign 2024 began with .env files that misconfigured web applications served to any unauthenticated request. The files held long-lived AWS access keys and other tokens, which attackers used to create administrator roles and extort victims. Permissions on the file system and the web server configuration together decide whether a secret is reachable; the better fix is a secrets manager. See the T1552 guide.
Mounted secrets in containers: Kubernetes documents that Secret volume files use permission 0644 if no mode is specified, and that defaultMode (for example 0400) sets the mode for the whole volume, with per-key overrides. JSON manifests need the decimal value, because JSON has no octal literals. Combine a restrictive mode with a non-root runAsUser. See the Kubernetes Secrets Security Guide.
SSH authorised keys: OpenSSH's StrictModes (default yes) makes sshd check file modes and ownership of the user's files and home directory before accepting login. That stops other users planting keys, but not the account owner, because the default AuthorizedKeysFile is .ssh/authorized_keys in the user's home. The Cursor Marketplace Extension Compromise 2026 shows the gap: a tampered extension running as the developer appended an attacker key to that user's authorized_keys. Pointing AuthorizedKeysFile at a root-owned path (it accepts the %u token for the user name) or using an AuthorizedKeysCommand, which sshd requires to be root-owned and not group or world writable, moves key control out of user reach. See the SSH Key Management Guide.

Service accounts that run software should never own their own binaries or configuration directories: if the account can write the file it executes, any compromise of the account becomes persistence. See the Windows Services and Service Account Security Guide and the Linux Service Accounts and Keytab Management Guide.

What M1022 does not stop

Gap	Why	What covers it
Attacker already root, SYSTEM or administrator	Owners and administrators can rewrite any ACL (T1222)	M1026 Privileged Account Management, M1018 User Account Management, M1052 User Account Control
Abuse of the user's own files	Shell profiles, user `authorized_keys` and user startup folders are writable by the account by design	Root-owned key locations, M1047 Audit, endpoint detection on profile and key changes
Code that runs from a writable location the business needs	Downloads and temp folders must stay writable	M1038 Execution Prevention (application control)
Secrets copied elsewhere	A correctly permissioned file can still be committed to Git, baked into an image or logged	Secret scanning and a secrets manager
Registry-based equivalents on Windows	Service configuration and autostarts also live in the registry	M1024 Restrict Registry Permissions

Implementation: a phased rollout

Discover: enumerate privileged executables (service binaries, scheduled task actions, systemd ExecStart targets, root cron entries) and test the ACL of each file and each parent folder for write access by non-administrative principals, including Everyone, Authenticated Users, BUILTIN\Users and service accounts. On Linux, find world-writable files and directories and files owned by non-root users under system paths.
Capture a rollback point: on Windows, icacls ... /save stores DACLs for later /restore; on Linux, getfacl -R output serves the same purpose.
Fix the high-priority rows first: service binaries and folders (T1569, T1574), unit and task definitions (T1543, T1053), logon scripts and NETLOGON (T1037), then authentication material (T1098.004, T1552.004).
Move secrets: secret files to owner-read-only, out of web roots and shares, and into a secrets manager where possible. Set defaultMode on Kubernetes Secret volumes.
Pilot and test: apply to a pilot image, run patching, software deployment and backup jobs, and watch for access-denied failures before broad rollout.
Enforce in the build: bake permissions into golden images and configuration management so new hosts start correct, and add a CI check that fails on world-writable or user-owned privileged files.
Monitor change: file integrity monitoring on the high-value paths and audit rules for permission changes, so drift is noticed.

Measuring and monitoring

Windows auditing: the Audit File System subcategory produces events such as 4663 (an attempt was made to access an object) and 4670 (permissions on an object were changed), but only for objects with a SACL. Microsoft advises planning SACLs before enabling it, because broad SACLs flood the log. Put SACLs on the high-value paths only.
Linux auditing: the auditctl manual describes -w path watches with -p as deprecated for performance reasons and recommends the syscall form, for example -a always,exit -F arch=b64 -F path=/etc/shadow -F perm=wa. Use the same form for sudoers, unit directories and key files.
Integrity monitoring: baseline hashes and modes of privileged files; see the File Integrity Monitoring Guide.

Metrics to report:

Privileged executables or their parent folders writable by non-administrators (target zero).
Secret and key files readable by anyone other than their owning identity (target zero).
World-writable files under system paths per host, trended across the estate.
Unapproved permission-change events (4670 or audit perm=a hits) on watched paths per month, and time to review.
Share folders granting write to broad groups such as Everyone or Domain Users.

Common failure patterns

Applications installed outside protected folders. Software in C:\Tools or a user profile inherits write access for users, giving T1574 and T1569 a clear path.
Service accounts that own what they run. Convenience at install time becomes persistence after compromise.
Secrets beside the code. .env and config files inside a web root or repository, protected only by the hope that nobody requests the path.
Auditing everything. Broad SACLs or watches generate so much noise that the permission-change events that matter are never reviewed.
Bulk ACL changes on system folders. Copying an example command onto System32 without testing can break servicing and gets rolled back, leaving nothing.
Shares with Everyone: Full Control. Broad write on shared folders is the T1080 path for tainting scripts and documents others will run.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	AC-3 Access Enforcement; AC-6 Least Privilege	Core of M1022
NIST SP 800-53 Rev. 5	CM-5 Access Restrictions for Change; CM-6 Configuration Settings	Who can change binaries, units and configuration
NIST SP 800-53 Rev. 5	AU-9 Protection of Audit Information; SI-7 Software, Firmware, and Information Integrity	Log file protection and integrity monitoring
NIST CSF 2.0	PR.AA-05; PR.PS-01	Permissions managed and enforced; configuration management
ISO/IEC 27001:2022 Annex A	A.8.3 Information access restriction	Restricting access to information and assets
MITRE D3FEND	D3-LFP Local File Permissions	The defensive technique D3FEND relates to M1022

Related mitigations: M1024 Restrict Registry Permissions, M1026 Privileged Account Management, M1028 Operating System Configuration, M1038 Execution Prevention and M1047 Audit. All are listed in the MITRE ATT&CK Mitigations hub.

Practitioner checklist

Inventory every privileged executable and check write access on the file and its parent folders.
Remove user, broad group and service account write from service binaries, task definitions and unit files.
Restrict logon scripts, NETLOGON and system-wide shell profiles to administrator write.
Set private keys, keytabs and credential files to owner read only, and keep secrets out of web roots and shares.
Set defaultMode on Kubernetes Secret volumes and run containers as non-root.
Consider a root-owned AuthorizedKeysFile or AuthorizedKeysCommand on servers where users should not self-manage SSH keys.
Save ACLs before every change and test on a pilot image.
Audit permission changes on high-value paths only, and forward the events.
Fail builds that produce world-writable or user-owned privileged files.

M1022 Restrict File and Directory Permissions: Permissions That Protect Secrets, Binaries and Scripts