TrymeLocker DestroyCMD - takeown and icacls prior to cmd.exe deletion

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule detects sequences of suspicious administrative commands often used by attackers to gain control over files or clear system artifacts. It monitors the combined use of 'takeown.exe' to change file ownership, 'icacls.exe' to modify file permissions, and 'cmd.exe' to perform mass file deletions, particularly targeting sensitive system directories like System32 or SysWOW64.