LCRYX Ransomware VBScript XOR File Encryption and PLEASEREADME.txt Ransom Note Drop
Detects LCRYX ransomware activity by monitoring wscript.exe or cscript.exe executing mass file renames with the .lcryx extension and the creation of PLEASEREADME.txt ransom notes within sensitive user directories.
Microsoft Sentinel (KQL)
