Suspicious Recursive Takeown

SigmaHQ Detections@sigmaHQ

•updated Nov 21, 2022•0•0•0

Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders