Discretionary Access Control Lists

On Windows, modify the DACL of a file or directory to change which principals can access it. Targets may be local or reachable through an authorized SMB share; an Internet-accessible variant requires the share to be deliberately exposed (for example, SMB over QUIC) and the caller to satisfy share and object-level authorization. The caller must own the target or have WRITE_DAC. This entry covers T1222.001 file and directory permissions, not service security descriptors, registry keys, or Active Directory object ACLs. A changed ACE may enable later access or escalation on a suitable target but does not establish effective access or privilege escalation.