Boot Sector Modification Detection

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•1

This rule detects suspicious file creation or modification events in the root directory (C:\) for files commonly associated with boot sectors, such as 'bootsect.bak', 'bootloader', 'MBR', and 'VBR'. Such modifications can indicate ransomware activity or other forms of boot integrity compromise.