BlueSky Ransomware File and Share Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•30

Detects access to files and shares with specific names and extensions associated with BlueSky ransomware, indicating a potential or active encryption attempt. The rule looks for files ending with '.bluesky' or containing 'DECRYPT FILES BLUESKY' in their names, across both local file access events (EventID 4663, 4656) and network share access events (EventID 5145).