Conti Ransomware Process Creation

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•2

Detects the creation of processes with command-line arguments containing keywords associated with Conti ransomware, such as 'conti', 'conti-drop', or 'conti-payload'. This rule monitors Windows Security Event ID 4688, which logs process creation.