LCRYX Ransomware VBScript XOR File Encryption and .lcryx Extension Appended
Detects LCRYX ransomware activity orchestrated by VBScript using wscript.exe or cscript.exe. The rule monitors for the mass encryption of files identified by the .lcryx extension and the creation of PLEASEREADME.txt ransom notes, typical behaviors of this ransomware variant.
Sigma
