Encrypted Container Naming in Windows Fonts

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•1•0•3

This rule detects the creation or modification of files within the Windows Fonts directory that use specific naming conventions (starting with 'x1', 'kx1', or 'kw1') and have no file extension or a generic one. This pattern is often associated with malware attempting to hide encrypted data containers or malicious payloads by masquerading them as legitimate system files.