icacls.exe

icacls.exe reads and writes the discretionary access control lists that decide who can read, write, or execute a file or directory. It can grant and deny rights to users (/grant, /deny), reset inherited permissions (/reset), change owner (/setowner), and set integrity levels. It requires rights over the target and lives at C:\Windows\System32\icacls.exe.

Legitimately, icacls is run by administrators and installers to configure access on files and folders. The target and the permission change are what give an instance meaning.

icacls.exe is used to manipulate file permissions for attacker ends (T1222.001). Granting full control to a broad principal opens files and folders an account should not reach, resetting or removing ACLs strips protections from security tools, logs, or backups so they can be tampered with, and changing ownership can lock the legitimate owner out. These moves often accompany ransomware and anti-forensics, ensuring the operator can read, modify, or destroy targeted data.

Because icacls is a normal administrative tool, the target path and the permission change are what matter. Broad grants to system locations, or ACL resets on defensive files, are very different from an installer setting permissions on its own directory.