Payouts King Ransom Note Drop - readme_locker File Creation on Disk
This rule monitors for the creation or modification of files containing the string 'readme_locker' in their filename. This pattern is commonly associated with ransomware strains that leave behind ransom notes, often as part of the data encryption impact phase.
Cortex XDR
