huntrule

Windows Suspicious takeown.exe Recursive Ownership Change

Alerts when takeown.exe is run with recursive and file/folder targeting, indicating potential defense impairment via ownership changes.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-01-30
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions of takeown.exe where the command line includes recursive file targeting (/r) and a specific path argument (/f). Attackers can use takeown to change ownership of files and folders, which may enable subsequent permission changes and defense evasion by impairing access controls. The detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.

Reporting behind it

Related detections9 linkedT1222.001 — drag to rearrange
Suspicious File Permission Grant to Everyone via Icacls (via process_creation)
Suspicious Permissions Modification on a Network Share (via security)
Malicious Computer Account Modifying Active Directory Permissions - PrivExchange (via security)
Suspicious Recursive icacls Grant of Full Access to Everyone via process_creation
Malicious Replication Privileges Granted to Perform DCSync Attack (via security)
Windows: fsutil SymlinkEvaluation behavior modification via command line
Windows Process Creation: File/Folder Permission Changes via cacls/icacls/net attrib/takeown
Windows Security: Detect WRITE_DAC on AD DS objects (Event ID 4662)
Windows process activity matching WannaCry executables and ransom note text
Windows Suspicious takeown.exe Recursive Ownership Change
Pivot detection · T1222.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.