Detect Ransomware Registry Extension Association Changes

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•2

This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.