Charon Ransomware Deployment and Activity Detection

Aamir Muhammad@Aamir

•updated Mar 25, 2026•4•0•63

This rule detects various stages of the Charon ransomware deployment and activity, including the writing of ransomware-related files to disk, malicious DLL side-loading, the deployment trigger, and the creation of ransom notes or service associated with Charon.