Mass File Encryption Consistent with INC Ransom or Lynx Ransomware Deployment
This rule detects potential ransomware activity by identifying processes that perform a high volume of file write, create, or rename operations across a large number of unique file paths within a short timeframe. It also includes a heuristic check for filenames containing 'inc' or 'lynx', often associated with specific ransomware variants.
Cortex XDR
