Ransomware File Hash IOC Detection

Ankit Mehta@Secvyn

•updated Jun 17, 2026•1•0•8

This rule detects the presence of files on devices that match known ransomware SHA256 hashes. It filters out common system processes (explorer.exe, svchost.exe, system.exe) as initiating processes to reduce false positives.