Charon Ransomware Activity Detection

Aamir Muhammad@Aamir

•updated Mar 25, 2026•10•0•128

This rule detects various activities associated with the Charon ransomware, including DLL sideloading, ransomware deployment, payload reading, ransom note creation, shadow copy deletion, and service creation for persistence. It leverages specific filenames, process behaviors, and registry modifications to identify the threat.