BARADAI Ransomware Go Binary Mass UNC Path I/O – T1486/T1021.002
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
Splunk (SPL)
