Grixba Ransomware Geofencing Locale Check
Detects attempts by the Grixba ransomware to query a specific custom locale registry key (en-US) for geofencing purposes. This activity is indicative of the ransomware checking the system's locale settings, potentially to avoid encrypting systems in certain geographical regions.
Microsoft Sentinel (KQL)
