Batch File Ransomware Execution

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•4

Detects suspicious execution patterns indicative of ransomware utilizing batch scripts. This rule triggers when 'cmd.exe' or 'powershell.exe' execute at least 5 times within a 5-minute window, with command lines containing '.bat', '.cmd', or '/c', suggesting automated script execution often seen in ransomware attacks.