Mass file encryption and ransom note drop indicative of INC Ransom/Lynx post-FortiBleed deployment
This rule monitors for two indicators of potential ransomware activity: first, a surge in file renaming or creation events across multiple directories within a short window, suggesting large-scale encryption; second, the creation of potential ransom note files across multiple directories or devices. It uses Microsoft Defender for Endpoint data to identify these patterns as part of an incident response strategy.
Microsoft Sentinel (KQL)
