Gentlemen - Rapid File Encryption Activity (T1486)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Detects the high-velocity renaming of files across user directories to append the .gentlemen extension, indicative of ransomware activity.