Ransom Note File Creation

Use case development / Protect Against Ransomware / Detect Ransomware Encryption Activity

sigma

Detection rule

title: Ransom Note File Creation
status: experimental
description: Detects creation of files with common ransomware note filenames
logsource:
  product: windows
  category: file_event
detection:
  selection:
    EventType: 'FileCreate'
    TargetFilename|contains:
      - 'README.txt'
      - 'HOW_TO_DECRYPT'
      - 'DECRYPT_INSTRUCTIONS'
      - '_readme.txt'
      - 'RECOVER-FILES'
  condition: selection
falsepositives:
  - Legitimate README files
level: critical
tags:
  - attack.impact
  - attack.t1486

Test cases

• Create file matching pattern in sensitive directory
• Verify legitimate README does not trigger

False positive guidance

Whitelist development directories where README creation is expected.

Detection course