TrymeLocker icacls/takeown File Permission Subversion on System Files

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

This rule detects bulk execution (5+ events within 60 seconds) of Windows system utilities icacls, cacls, and takeown. These tools are commonly used by adversaries to modify file or directory permissions (DACLs) to gain access to protected files or maintain persistence. The rule specifically monitors for common patterns used to grant access to sensitive users (e.g., Everyone, Administrators) or interaction with critical system paths.