Gunra ransomware .ENCRT file extension detection
Detects mass file rename/write events producing the distinctive .ENCRT extension used by Gunra's ChaCha20+RSA-4096 encryptor, scoped narrowly to avoid matching legitimate bulk file operations.
Microsoft Sentinel (KQL)
