RestartManager Ransomware File Unlocking

Bryant Smith@flowstate

•updated Mar 21, 2026•0•93

Detects a sudden spike in Windows RestartManager Event ID 10000. A proliferation of RestartManager events is a strong indicator of active file encryption by ransomware (like INC or Akira) attempting to kill processes that are locking target files.