TrymeLocker cmd.exe Permanent Deletion via takeown and icacls

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects suspicious execution patterns involving Windows file management utilities (takeown.exe, icacls.exe) or the deletion of command-line interpreter binaries through cmd.exe. These patterns are often associated with unauthorized modifications of file permissions or attempts to clear forensic evidence during an intrusion.