Lalia Ransomware Extension Mass Rename

Daniel Jeremiah@daniyyell

•updated Jun 14, 2026•0•0•2

This rule flags a large number of files receiving a '.lalia' extension at once, indicating potential Lalia ransomware activity. Bulk extension changes are a common initial indicator of ransomware infection. The rule looks for at least 20 file events (renamed, created, or modified) where the file name ends with '.lalia' within a 30-day window.