The Gentlemen Ransomware Pre-Encryption File Permission Modification

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•4

Detects bulk file permission changes using native Windows utilities like icacls, cacls, or takeown. The rule flags instances where non-Microsoft signed processes execute these commands repeatedly (more than 5 times) within a short window, which is often indicative of automated privilege escalation or an attempt to weaken file access controls across a system.