Mass File Rename to .God8Damn or Custom Victim-Org Extension (GodDamn Ransomware)

Duo Tech@duotech

•updated Jul 13, 2026•3•0•7

This rule detects potential ransomware activity by monitoring for high-frequency file rename events (more than 50 in a single dataset aggregation) or file renames resulting in the specific extension '.God8Damn'. Such patterns are highly characteristic of ransomware encrypting local or network files.