Detect Files with Ramsomware Extensions

This hunting query identifies cretion of files with ransomware extensions. Ransomware file extensions are defined in a watchlist named RansomwareFileExtensions.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Linux macOS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source product: ciscosecureendpoint crowdstrikefalconendpointprotection microsoftthreatprotection sentinelone trendmicroapexone trendmicroapexoneama vmwarecarbonblack
Log source service: carbonblackevents_cl ciscosecureendpoint_cl commonsecuritylog securityalert sentinelone_cl tmapexoneevent

Detection rules

Detect Files with Ramsomware Extensions

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules