Renamed MegaSync Execution by Ransomware
Detects the execution of a renamed MegaSync.exe, which has been observed in use by ransomware families such as Nefilim, Sodinokibi (REvil), Pysa, and Conti. The rule specifically looks for processes where the original filename metadata is 'megasync.exe' but the executed image path does not end with '\megasync.exe', indicating a renaming event.
Sigma
