Deimos Ransomware IOC Detection

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•4

This rule detects the creation or renaming of files with specific names associated with Deimos ransomware, including '.deimos', '.payment_id', or 'deimos_note'. These file names are commonly used by Deimos ransomware for encrypted files or ransom notes.