Activity timeline
T1222.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-09 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.
How adversaries use it
T1222.001 Windows Permissions is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix, as a sub-technique of T1222 File and Directory Permissions Modification. Threadlinqs maps 10 of 3820 tracked threats (0.3%) to it; by severity that is 1 critical, 5 high, 4 medium.
Threats that use T1222.001 most often also use T1059.001 PowerShell (7 threats), T1489 Service Stop (7 threats), T1059.003 Windows Command Shell (6 threats), T1053.005 Scheduled Task (5 threats), T1490 Inhibit System Recovery (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
5 tracked threat actors appear in the threats that use T1222.001; the most frequent are Void Arachne (2), ALPHV (1), APT28 (1), BlackCat (1), The Gentlemen (1).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1222.001.
Data sources
Telemetry that can reveal T1222.001, per MITRE ATT&CK.
- Active Directory — Active Directory Object Modification
- Command — Command Execution
- File — File Metadata
- Process — Process Creation
Threat actors using it
Tracked threats
10 tracked threats use T1222.001.
- AntiFox agentic AI pentest platform (ARTEX fork) abused in IIS webshell to AWS credential-theft intrusionshigh
- APT28 (Fancy Bear) Espionage Campaign Against European Defense Contractors Using Hookedge Backdoorhigh
- Gentlemen Ransomware (Storm-2697): Double-Extortion RaaS with Fortinet Exploitation, BYOVD EDR Killers and…high
- SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows…high
- Ryuk Ransomware Initial Access Operator Karen Vardanyan ("Maneeken") Sentenced to 24 Months in U.S. Federal…medium
- Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor…high
- HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege…medium
- AnyDesk "Send Support Information" Link-Following Denial-of-Service (CVE-2026-15682)medium
- Former DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Extortion…medium
- CISA KEV Catalog Update: Seven Actively Exploited Vulnerabilities Added 2026-04-13 (Microsoft, Adobe…critical
Detection coverage
Threadlinqs maintains 18 detection rules mapped to T1222.001 (SPL 5, KQL 7, Sigma 6). Rule content unlocks with TL Creds on a free account; this page shows counts only.
Parent technique
T1222 File and Directory Permissions Modification — 34 tracked threats at the technique level.