Millenium RAT file encryption/decryption command and mass file activity
This rule detects potential ransomware or remote access trojan (RAT) activity by identifying either specific command-line indicators (/encrypt, /decrypt) or a high volume of file modifications (create, modify, or rename) across multiple directories within a short time frame, which is characteristic of mass file encryption operations.
Microsoft Sentinel (KQL)
