GigaWiper boot file destruction via takeown/icacls/del on winload/ntoskrnl/bootmgr

Ethan Andrews@eandrews

•updated Jul 9, 2026•3•0•4

Detects the use of administrative utilities (takeown, icacls, del) to modify permissions on and subsequently delete critical Windows boot files (winload.exe, winload.efi, ntoskrnl.exe, bootmgr). This activity is associated with GigaWiper and is intended to render the target operating system unbootable.