Reynolds Ransomware Drops __RestoreYourFiles__.txt in Word STARTUP Folder
Detects the creation of a file named '__RestoreYourFiles__.txt' within the Microsoft Word STARTUP folder. This file name and location are commonly associated with ransomware activity, specifically the BlackByte ransomware, which drops this file as a ransom note.
Microsoft Sentinel (KQL)
