NoEscape wiper stages mismatched-extension image files at C:\ root
Detects the creation of specific image files (e.g., .png, .bmp) at the root of the system drive (C:\). This behavior is associated with certain ransomware strains (such as NoEscape) that stage files with misleading extensions in unusual locations to evade detection.
Sigma
