Potential Ryuk Ransomware Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•35

Detects potential Ryuk ransomware activity by looking for specific command-line patterns. This includes attempts to establish persistence via the Run registry key, deletion of backup files, and stopping critical services using 'net stop' commands.