C3RB3R ransomware mass .L0CK3D file renaming
Detects mass creation or renaming of files with the .L0CK3D extension (associated with C3RB3R / eCh0raix ransomware) within a short timeframe across multiple folders, optionally correlated with the creation of the read-me3.txt ransom note.
Microsoft Sentinel (KQL)
