TrymeLocker file permission modification via icacls, cacls, or attrib in system directories
Detects the use of built-in Windows utilities (icacls.exe, cacls.exe, attrib.exe) to modify file permissions (granting or denying access) or file attributes (hidden/system) on sensitive Windows directories or specific suspicious filenames often associated with malicious activity.
Splunk (SPL)
