Lateral Movement Indicators Post-Ransomware Encryption

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•1

This rule detects network connections to common lateral movement ports (SMB, NetBIOS, RDP, FTP, Telnet, SSH) occurring within a 30-minute window before or a 60-minute window after the execution of known ransomware encryption binaries ('servertool.exe', 'encrypt.exe'). This correlation aims to identify post-encryption lateral movement attempts by ransomware, potentially for further compromise or data exfiltration.