Ransomware Registry Indicator
This rule detects potential ransomware activity by monitoring Windows Security Event ID 4657 (Registry Value Modified) for specific keywords commonly associated with ransomware notes or demands. It looks for terms like 'ransom', 'payment', 'decrypt', 'unlock', 'bitcoin', and 'monero' within the new value of a modified registry key, specifically within the 'Run' or 'Software' registry paths. This could indicate a ransomware variant attempting to establish persistence or store its ransom note details in the registry.
Microsoft Sentinel (KQL)
