Payouts King Ransom Note readme_locker.txt Dropped on Desktop
Detects the creation of files commonly used as ransom notes (e.g., 'readme_locker' or 'readme_locker.txt') within common user directories such as the Desktop. This behavior is a strong indicator of a ransomware attack post-encryption.
Microsoft Sentinel (KQL)
