Mass file encryption with INC/Lynx ransomware extensions

Ibrahim Saud@tektrix

•updated Jul 3, 2026•5•0•23

Detects high-volume file creation events (more than 50 within 5 minutes) on an endpoint using specific file extensions associated with known ransomware families such as INC Ransom (.inc) and Lynx (.lynx).