Extortion Table (README_RANSOM) Creation with Bitcoin/Contact Indicators

Duo Tech@duotech

•updated Jul 8, 2026•1•0•6

This rule monitors process command lines and file operations for specific strings associated with ransomware, including known ransom note naming conventions ('readme_ransom'), a specific Bitcoin wallet address, a contact email, and SQL commands commonly used to drop database tables for ransom purposes.