INC Ransom mass file encryption via .inc extension rename
Detects high-volume file modification events resulting in files renamed with the .inc extension, which is a characteristic behavior of the INC ransomware strain. The rule monitors for more than 50 such modifications on a single host within a 10-minute window, serving as an indicator of active encryption and potential ransomware impact.
YARA-L
