Qilin - Rapid Multi-Directory File Rename (Encryption Indicator)

Ibrahim Saud@tektrix

•updated Jun 17, 2026•3•0•14

Detects rapid sequential file rename/write operations across multiple directories within a short window, which is a behavioral signature of active ransomware encryption activity. The rule specifically looks for more than 200 file operations (renamed or created) with a file extension matching a 4-8 character alphanumeric pattern, across more than 5 unique folders, all occurring within a 2-minute window and completing within 120 seconds.