INC Ransomware Command Execution

Bryant Smith@flowstate

•updated Mar 21, 2026•0•66

Detects the execution of INC ransomware utilizing specific command-line arguments (--sup, --hide, --mode medium) typically staged from the C:\perflogs\ directory. This pattern indicates active ransomware execution during the impact phase of an attack.