Procedure examples

WastedLocker has a command to take ownership of a file and reset the ACL permissions using the takeown.exe /F filepath command.

BlackCat can use Windows commands such as `fsutil behavior set SymLinkEvaluation R2L:1` to redirect file system access to a different location after gaining access into compromised networks.

WannaCry uses attrib +h and icacls . /grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls.

BlackByte Ransomware uses the `mountvol.exe` command to mount volume names and leverages the Microsoft Discretionary Access Control List tool, `icacls.exe`, to grant the group to “Everyone” full access to the root of the drive.

Grandoreiro can modify the binary ACL to prevent security tools from running.

Ryuk can launch icacls <path> /grant Everyone:F /T /C /Q to delete every access-based restrictions on files and directories.

CaddyWiper can modify ACL entries to take ownership of files.

JPIN can use the command-line utility cacls.exe to change file permissions.

BitPaymer can use icacls /reset and takeown /F to reset a targeted executable's permissions and then take ownership.

Diskpart can be used to display, set, or clear attributes of a disk or volume.