Mass File Encryption and Ransom Note Surge Consistent with INC Ransom/Lynx Post-FortiBleed Compromise
Detects high-frequency file write activity combined with the creation of text files, which is a common behavior exhibited by ransomware during the encryption phase of an attack. The rule monitors for a large volume of file creations across a host and specific patterns indicative of ransom note generation.
CQL
