The Gentlemen RaaS Pre-Encryption File Permission Modification via icacls/cacls/takeown
Detects the execution of Windows file permission management utilities (icacls.exe, cacls.exe, takeown.exe) when multiple instances occur within a short window (5 minutes). This behavior is often associated with ransomware groups preparing systems for encryption by restricting user access to files.
YARA-L
