Windows Suspicious takeown.exe Recursive Ownership Change

Alerts when takeown.exe is run with recursive and file/folder targeting, indicating potential defense impairment via ownership changes.

FreeUnreviewedSigmamediumv1

windows-suspicious-takeown-exe-recursive-ownership-change-554601fb

title: Windows Suspicious takeown.exe Recursive Ownership Change
id: 01113770-ae76-436a-8e78-290e29e05336
status: test
description: This rule flags process executions of takeown.exe where the command line includes recursive file targeting (/r) and a specific path argument (/f). Attackers can use takeown to change ownership of files and folders, which may enable subsequent permission changes and defense evasion by impairing access controls. The detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_takeown_recursive_own.yml
author: frack113, Huntrule Team
date: 2022-01-30
modified: 2022-11-21
tags:
  - attack.defense-impairment
  - attack.t1222.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \takeown.exe
    CommandLine|contains|all:
      - "/f "
      - /r
  condition: selection
falsepositives:
  - Scripts created by developers and admins
  - Administrative activity
level: medium
license: DRL-1.1
related:
  - id: 554601fb-9b71-4bcc-abf4-21a611be4fde
    type: derived

What it detects

This rule flags process executions of takeown.exe where the command line includes recursive file targeting (/r) and a specific path argument (/f). Attackers can use takeown to change ownership of files and folders, which may enable subsequent permission changes and defense evasion by impairing access controls. The detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.

Known false positives

Scripts created by developers and admins
Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.