TrymeLocker ACL Manipulation via icacls/takeown on System Executables

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects the use of native Windows utilities (icacls.exe, cacls.exe, takeown.exe) to modify file or directory permissions or ownership in a manner consistent with adversarial activity. This includes granting full permissions to everyone/administrators, or changing ownership of critical system directories (e.g., windows, system32) to standard user accounts. The rule includes logic to filter out known legitimate administrative processes and flags potential suspicious parent processes.