TrymeLocker cmd.exe Deletion and Permission Modification via DestroyCMD

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•3

Detects behavior associated with TrymeLocker ransomware, specifically the removal of critical Windows components like cmd.exe. The rule monitors for the sequence of taking file ownership using takeown.exe, modifying file permissions with icacls.exe to grant full access, and subsequent deletion of the file using del commands. It also identifies Sysmon file deletion events targeting cmd.exe within system directories by non-system processes.