# T1222.001 Windows Permissions > As of 2026-11-11, T1222.001 (Windows Permissions) appears in 10 tracked threats, first reported 2026-04-13 and most recently 2026-11-11, with linked actors including Void Arachne, ALPHV, APT28; it most often appears alongside T1059.001 (PowerShell). - **Tracked threats:** 10 (1 critical, 5 high, 4 medium) - **First seen:** 2026-04-13 - **Last seen:** 2026-11-11 - **Threat actors:** 5 - **Detection rules:** 18 (counts only; unlock with TL Creds) ## Key facts - **ID:** T1222.001 - **Framework:** MITRE ATT&CK - **Tactics:** Defense Impairment - **Matrix:** Enterprise - **Parent:** T1222 - **Data as of:** 2026-11-11 - **MITRE:** https://attack.mitre.org/techniques/T1222/001/ ## Activity timeline T1222.001 first appeared in tracked threats on 2026-04-13 and was most recently reported on 2026-11-11. The busiest month was 2026-09 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11. ## How adversaries use it T1222.001 Windows Permissions is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix, as a sub-technique of [T1222 File and Directory Permissions Modification](https://intel.threadlinqs.com/technique/T1222). Threadlinqs maps 10 of 3820 tracked threats (0.3%) to it; by severity that is 1 critical, 5 high, 4 medium. Threats that use T1222.001 most often also use [T1059.001 PowerShell](https://intel.threadlinqs.com/technique/T1059.001) (7 threats), [T1489 Service Stop](https://intel.threadlinqs.com/technique/T1489) (7 threats), [T1059.003 Windows Command Shell](https://intel.threadlinqs.com/technique/T1059.003) (6 threats), [T1053.005 Scheduled Task](https://intel.threadlinqs.com/technique/T1053.005) (5 threats), [T1490 Inhibit System Recovery](https://intel.threadlinqs.com/technique/T1490) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 5 tracked threat actors appear in the threats that use T1222.001; the most frequent are [Void Arachne](https://intel.threadlinqs.com/actor/Void%20Arachne) (2), [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) (1), [APT28](https://intel.threadlinqs.com/actor/APT28) (1), [BlackCat](https://intel.threadlinqs.com/actor/BlackCat) (1), [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen) (1). ## Mitigations MITRE ATT&CK lists 2 mitigations for T1222.001. - [M1022 Restrict File and Directory Permissions](https://attack.mitre.org/mitigations/M1022/) - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) ## Data sources Telemetry that can reveal T1222.001, per MITRE ATT&CK. - Active Directory — Active Directory Object Modification - Command — Command Execution - File — File Metadata - Process — Process Creation ## Threat actors using it - [Void Arachne](https://intel.threadlinqs.com/actor/Void%20Arachne) — 2 - [ALPHV](https://intel.threadlinqs.com/actor/ALPHV) — 1 - [APT28](https://intel.threadlinqs.com/actor/APT28) — 1 - [BlackCat](https://intel.threadlinqs.com/actor/BlackCat) — 1 - [The Gentlemen](https://intel.threadlinqs.com/actor/The%20Gentlemen) — 1 ## Tracked threats 10 tracked threats use T1222.001. - [AntiFox agentic AI pentest platform (ARTEX fork) abused in IIS webshell to AWS credential-theft intrusions](https://intel.threadlinqs.com/threat/TL-2026-5777) — high — 2026-11-11 - [APT28 (Fancy Bear) Espionage Campaign Against European Defense Contractors Using Hookedge Backdoor](https://intel.threadlinqs.com/threat/TL-2026-3949) — high — 2026-10-20 - [Gentlemen Ransomware (Storm-2697): Double-Extortion RaaS with Fortinet Exploitation, BYOVD EDR Killers and…](https://intel.threadlinqs.com/threat/TL-2026-3832) — high — 2026-10-17 - [SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows…](https://intel.threadlinqs.com/threat/TL-2026-2773) — high — 2026-09-29 - [Ryuk Ransomware Initial Access Operator Karen Vardanyan ("Maneeken") Sentenced to 24 Months in U.S. Federal…](https://intel.threadlinqs.com/threat/TL-2026-2634) — medium — 2026-09-23 - [Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor…](https://intel.threadlinqs.com/threat/TL-2026-2283) — high — 2026-09-01 - [HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege…](https://intel.threadlinqs.com/threat/TL-2026-2258) — medium — 2026-08-31 - [AnyDesk "Send Support Information" Link-Following Denial-of-Service (CVE-2026-15682)](https://intel.threadlinqs.com/threat/TL-2026-1423) — medium — 2026-07-16 - [Former DigitalMint Ransomware Negotiator Angelo Martino Sentenced to 70 Months for BlackCat/ALPHV Extortion…](https://intel.threadlinqs.com/threat/TL-2026-1166) — medium — 2026-07-10 - [CISA KEV Catalog Update: Seven Actively Exploited Vulnerabilities Added 2026-04-13 (Microsoft, Adobe…](https://intel.threadlinqs.com/threat/TL-2026-0357) — critical — 2026-04-13 ## Related CVEs CVEs referenced by the tracked threats that use T1222.001, most frequent first. - [CVE-2012-1854](https://intel.threadlinqs.com/cve/CVE-2012-1854) - [CVE-2020-9715](https://intel.threadlinqs.com/cve/CVE-2020-9715) - [CVE-2023-21529](https://intel.threadlinqs.com/cve/CVE-2023-21529) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2023-36424](https://intel.threadlinqs.com/cve/CVE-2023-36424) - [CVE-2024-37085](https://intel.threadlinqs.com/cve/CVE-2024-37085) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2025-32433](https://intel.threadlinqs.com/cve/CVE-2025-32433) - [CVE-2025-32463](https://intel.threadlinqs.com/cve/CVE-2025-32463) - [CVE-2025-33073](https://intel.threadlinqs.com/cve/CVE-2025-33073) - [CVE-2025-60710](https://intel.threadlinqs.com/cve/CVE-2025-60710) - [CVE-2025-70795](https://intel.threadlinqs.com/cve/CVE-2025-70795) - [CVE-2025-7771](https://intel.threadlinqs.com/cve/CVE-2025-7771) - [CVE-2026-15681](https://intel.threadlinqs.com/cve/CVE-2026-15681) - [CVE-2026-15682](https://intel.threadlinqs.com/cve/CVE-2026-15682) - [CVE-2026-21643](https://intel.threadlinqs.com/cve/CVE-2026-21643) - [CVE-2026-34621](https://intel.threadlinqs.com/cve/CVE-2026-34621) ## Detection coverage Threadlinqs maintains 18 detection rules mapped to T1222.001 (SPL 5, KQL 7, Sigma 6). Rule content unlocks with TL Creds on a free account; this page shows counts only. 18 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds ## Parent technique [T1222 File and Directory Permissions Modification](https://intel.threadlinqs.com/technique/T1222) — 34 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1222.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp