TrymeLocker File Permission Modification via icacls/cacls/attrib (T1222.001)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects evidence of TrymeLocker or similar ransomware behavior by identifying the simultaneous use of Windows utilities (icacls, cacls, takeown, attrib) to modify permissions on critical system directories or obscure executables, correlated with the deletion of volume shadow copies or disabling of system recovery features.