Gentlemen Ransomware Creates and Removes wipefile.tmp

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•5

Detects the creation and subsequent deletion or modification of 'wipefile.tmp' or similarly named temporary wipe artifacts, which are used by the Gentlemen ransomware during its cleanup phase. This rule specifically looks for file events (creation, deletion, modification) related to this filename.