BLUERABBIT Boot File Permission Tampering
Detects the modification of file permissions on critical Windows boot files (bootmgr, ntoskrnl.exe, winload.exe, winload.efi, winload) using `takeown.exe` or `icacls.exe`. This activity is a known precursor to BLUERABBIT's destructive wiping phase, where it attempts to render systems unbootable.
Microsoft Sentinel (KQL)
