Add FileOwnershipTakeover signature for detection

[kevross33]

8ed4d1a368ada7db7c22b472c357c9401a445c1155f8f455d209759df1f9884f

a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea (CaddyWiper)

[gemini-code-assist]

Code Review

This pull request introduces a new Windows signature module, FileOwnershipTakeover, designed to detect file and directory ownership changes using system utilities like takeown.exe, icacls.exe, PowerShell, and secedit.exe. The review feedback highlights several critical improvement opportunities to prevent bypasses and correct logical discrepancies: 1) Fixing a logical bug where high-value path detection for takeown is incorrectly nested inside the bulk-action check; 2) Normalizing path separators (replacing / with \) when checking against high-value target paths to prevent bypasses; and 3) Supporting both forward slash (/) and hyphen (-) argument prefixes for command-line utilities (takeown, icacls, and secedit).

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.