On Windows, adversaries may modify file or directory DACLs or attributes to change access to protected objects. Depending on the object's existing permissions and the caller's rights, this may require taking ownership or an elevated privilege. Changes can enable access, modification, replacement, or deletion. Changing Read-only, System, or Hidden attributes does not itself grant DACL permissions or elevate a process.
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER