Beast/GodDamn ransomware encryptor mass file rename with ransom note drop
This rule detects potential ransomware activity by monitoring for high-frequency file renaming operations combined with the presence of specific file extensions often associated with encryption and the concurrent creation of ransom note files (e.g., 'README.TXT').
Microsoft Sentinel (KQL)
