Medusa Ransomware Extension Detection (High-Tempo File Renames)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•5

Detects the high-tempo Medusa ransomware encryption phase by identifying a large number of file renaming operations that append the '.medusa' extension within a short timeframe (1 minute). This rule specifically looks for more than 50 such rename events per device per minute.