Nightspire - High-Frequency File Encryption (T1486)
Uses time-series aggregation to detect massive bursts of file renaming events across user directories, where files are appended with the .nightspire extension.
Microsoft Sentinel (KQL)
Uses time-series aggregation to detect massive bursts of file renaming events across user directories, where files are appended with the .nightspire extension.
Already have an account?