takeown.exe

takeown.exe reassigns ownership of files and directories. Ownership is the one right an account can always change permissions on, so taking ownership is the first step to rewriting a file's access control. It is typically paired with icacls.exe: takeown to seize ownership, then icacls to grant the desired rights. It requires sufficient privilege and lives at C:\Windows\System32\takeown.exe.

Legitimately, takeown is used by administrators recovering access to files whose permissions exclude them. The target it seizes is what gives an instance meaning.

takeown.exe is used to seize control of files (T1222.001). By taking ownership of a target, an attacker gains the ability to rewrite its permissions, which is why takeown and icacls so often appear back to back: takeown to claim the file, icacls to grant access. Applied to system binaries, security-tool files, logs, or backups, it is a setup move for tampering, destruction, or replacing a trusted file.

Because takeown is a legitimate recovery tool, the target and what follows are what matter. Ownership changes on defensive or system files, especially recursively or chained with icacls, point to an attacker clearing the way rather than an admin fixing access.