NoEscape takeown.exe ownership takeover of User Account Pictures folder
Detects the use of the Windows 'takeown.exe' utility to recursively change the ownership of the 'Microsoft\User Account Pictures' directory. This specific behavior is associated with the NoEscape ransomware, which modifies permissions on system folders to facilitate file encryption or impede recovery operations.
Sigma
