Gentlemen - Self-Propagating Binary Execution

Ibrahim Saud@tektrix

•updated Jun 21, 2026•2•0•5

Detects the execution of the Go-compiled Gentlemen ransomware payload from unusual directories, exhibiting self-propagation mechanisms. This rule specifically looks for executables with a generic name pattern (e.g., 'abc.exe') in common temporary or shared directories (Temp, Downloads, Public, ProgramData) and command-line arguments indicative of propagation, scanning, or encryption activities.