GentlemanRansomware Detection
This rule detects activities characteristic of the 'Gentleman' ransomware, including the creation of a specific ransom note file ('README-GENTLEMAN.txt'), attempts to tamper with Windows Defender security preferences, and the destruction of system recovery artifacts such as Volume Shadow Copies and various system logs/prefetch files.
Sigma
