LockBit Ransomware File Creation

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•1

Detects the creation of files with names commonly associated with LockBit ransomware, such as '.lockbit', 'lockbit_note', or '.abcd'. This rule specifically looks for these file names being created on devices, which is indicative of ransomware activity.