[RW] - Detect suspicious files dropped into Public Folder

Sergio Albea@Sergio_Albea

•updated Sep 10, 2025•6•0•71

Another common behaviour is dropping ransom notes in the 'C:\Users\Public' folder to notify about the encryption and the details for the corresponding payments. I recommend you to execute this KQL query to see if you have some false positive to whitelist them as I have with .lnk files ( basically browser shortcuts)