The Gentlemen Ransomware File Permission Modification via icacls/attrib/takeown

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the use of built-in Windows administrative utilities (icacls, cacls, takeown, attrib) to modify file permissions or attributes. This behavior is commonly observed during the staging phase of The Gentlemen ransomware attacks to restrict user access to files or hide malicious payloads prior to encryption.