Chaos ransomware read_it.txt ransom note dropped across multiple folders
Detects Chaos ransomware behavior where multiple 'read_it.txt' ransom notes are dropped across different directories within a short time window using Sysmon File Creation telemetry.
Splunk (SPL)

