Mass drop and display of ransom note text files without file encryption
Detects the mass creation of potential ransomware note files (e.g., decrypt.txt, recover.hta) across different directories on a single host. The rule correlates this file creation activity with the execution of common viewers (notepad.exe, mshta.exe, wordpad.exe) using the note file in the command line, while specifically excluding scenarios where standard file encryption activity is concurrent.
Microsoft Sentinel (KQL)
