Windows System File Ownership Change via Takeown or Icacls

Attackers often modify file and directory ownership to bypass access control lists (ACLs), thereby gaining unauthorized access to protected files. This tactic allows adversaries to manipulate system configurations, install malicious software, or steal sensitive data. This behavior is commonly seen after initial compromise, used to gain persistence or escalate privileges. The technique involves using built-in Windows utilities such as takeown.exe and icacls.exe with specific parameters to take ownership or modify permissions of critical system files and directories. The described detection focuses on identifying the execution of these tools with arguments that grant broad access, like granting full control to "Everyone." This can occur on any Windows system where an attacker has gained sufficient privileges to execute these commands.

Attack Chain

1. Initial Access: The attacker gains initial access to the system through methods such as exploiting a vulnerability, or using compromised credentials.
2. Privilege Escalation: The attacker escalates privileges to a level where they can execute administrative commands.
3. Identify Target Files: The attacker identifies critical system files or directories for permission modification, often located within the C:\Windows\ directory.
4. Take Ownership: The attacker uses takeown.exe /f <target_file> to take ownership of the targeted system file.
5. Modify Permissions: The attacker then uses icacls.exe <target_file> /grant Everyone:F to grant full control permissions to the "Everyone" group, effectively bypassing existing ACLs.
6. Access Protected Resources: The attacker leverages the modified permissions to access or modify previously protected resources.
7. Persistence: The attacker establishes persistence by modifying system files to ensure continued access, even after reboots or security updates.

Impact

Successful execution of this attack can lead to a complete compromise of the affected system. An attacker can modify sensitive system files, install malware, steal confidential information, and potentially move laterally within the network. This can affect all Windows systems where an attacker has gained sufficient privileges. The number of affected systems is dependent on the scope of the initial breach and the attacker's ability to move laterally.

Recommendation

• Deploy the Sigma rule "System File Ownership Change" to your SIEM and tune for your environment to detect suspicious usage of icacls.exe or takeown.exe (see rule section).
• Monitor process creation events for icacls.exe and takeown.exe with command-line arguments that modify ownership or permissions of system files, using process creation logs.
• Investigate any alerts generated by the Sigma rule and validate whether the observed activity is legitimate or malicious (see rule section).
• Implement strict access controls and regularly review and audit user permissions on critical system files and directories.
• Enable Sysmon process-creation logging to activate the rules above.