Windows Suspicious takeown.exe Recursive Ownership Change
Alerts when takeown.exe is run with recursive and file/folder targeting, indicating potential defense impairment via ownership changes.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-30
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of takeown.exe where the command line includes recursive file targeting (/r) and a specific path argument (/f). Attackers can use takeown to change ownership of files and folders, which may enable subsequent permission changes and defense evasion by impairing access controls. The detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_takeown_recursive_own.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious takeown.exe Recursive Ownership Change
id: 01113770-ae76-436a-8e78-290e29e05336
status: test
description: This rule flags process executions of takeown.exe where the command line includes recursive file targeting (/r) and a specific path argument (/f). Attackers can use takeown to change ownership of files and folders, which may enable subsequent permission changes and defense evasion by impairing access controls. The detection relies on Windows process creation telemetry capturing the executable path and command-line arguments.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_takeown_recursive_own.yml
author: frack113, Huntrule Team
date: 2022-01-30
modified: 2022-11-21
tags:
- attack.defense-impairment
- attack.t1222.001
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \takeown.exe
CommandLine|contains|all:
- "/f "
- /r
condition: selection
falsepositives:
- Scripts created by developers and admins
- Administrative activity
level: medium
license: DRL-1.1
related:
- id: 554601fb-9b71-4bcc-abf4-21a611be4fde
type: derived