FunkLocker Ransomware File Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•19•0•29

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware. This indicates that a system is actively being encrypted by this specific ransomware.