File Hash Match from Unauthorized Initiating Processes

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•4

This rule detects the presence of files on devices that match known ransomware SHA256 hashes. It filters out common system processes (explorer.exe, svchost.exe, system.exe) as initiating processes to reduce false positives.