Lalia Ransom Note Creation
This rule watches for creation of ransom notes associated with the Lalia family. Notes often appear in multiple folders once encryption finishes. Identify patient zero and check offline backups. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
