01flip Ransomware Artifacts Detection

nomit vyas@xoxo

•updated Jan 29, 2026•1•1•59

This rule detects the specific artifacts associated with the '01flip' ransomware. It triggers when a ransom note named 'RECOVER-YOUR-FILE.TXT' is created, followed by the rapid renaming of more than 10 files on the same host with the '.01flip' extension. The correlation is based on the hostname and the process command line within a 5-minute window, indicating a coordinated ransomware attack.