BlackCat/ALPHV Ransomware File Encryption Activity

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•2

Detects file creation or renaming events indicative of BlackCat/ALPHV ransomware encryption activity. The rule looks for specific file name patterns and extensions associated with this ransomware, such as '.blackcat', '.b1ack', '.alphv', or '.encrypted', and triggers if 20 or more such files are observed within a 5-minute window on a single device.