Gentlemen RaaS: icacls/attrib File Permission Modification on Staging Dirs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of Windows command-line utilities (icacls, cacls, attrib, takeown) used to modify file permissions or attributes, specifically when these operations are directed at sensitive system or temporary directories (e.g., ProgramData, Temp, AppData, etc.) and executed by non-system service accounts.