Access Control

In Windows, securable objects are objects like files, directories, registry items, processes, threads, Windows services, network shares, and active directory objects. Securable objects include a discretionary access control list (DACL) that contains access control entries (ACEs). Administrators and attackers need to be able to read, manipulate, and modify DACLs and ACEs with tools like PowerShell, accesschk, icacls or AccessEnum. The "sticky keys" attack modifies Windows system files to enable persistent access to the system; doing so requires first modifying the file permissions. These modifications can be detected and remediated by Windows resource protection.