Detect Ransomware Ransom Note Creation

Ankit Mehta@Secvyn

•updated Jun 30, 2026•7•0•4

This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.