Ransomware Killswitch Domain Resolution

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects attempts by a device to resolve specific domain names known to be associated with ransomware killswitches. Successful resolution of these domains could indicate a ransomware infection attempting to halt its encryption process.