PowerShell AES File Encryption, Mass Rename & Ransom Note Drop (T1486/T1059.001)

Renata Cardoso@rcardososec

•updated Jul 21, 2026•4•0•14

This rule detects potential ransomware activity by monitoring for specific PowerShell commands associated with file encryption (AES, CreateEncryptor, TransformFinalBlock) and suspicious file manipulation patterns, such as mass renaming of files with common ransomware extensions or the dropping of known ransom note filenames.