Suspicious Recursive Takeown Execution
This rule detects the execution of the `takeown.exe` utility with the `/f` (force) and `/r` (recursive) flags. Adversaries may use `takeown.exe` to gain ownership of files or directories, especially when combined with recursive operations, to bypass access controls and modify permissions. This action can be a precursor to further malicious activities such as modifying system files, installing persistence mechanisms, or exfiltrating data.
Sigma
