Potential Ransomware Activity Using LegalNotice Message
Detects modifications to the 'LegalNoticeCaption' or 'LegalNoticeText' registry values that include keywords commonly found in ransomware ransom messages. This activity is often associated with ransomware operations attempting to display a ransom note to users upon login.
Sigma
