AvosLocker Ransomware Command Line Detection

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•0

This rule detects the execution of processes with command-line arguments indicative of AvosLocker ransomware activity. It specifically looks for keywords such as 'avoslocker', 'av0s', 'locker-payload', and 'av0s-ransom' within process command lines, which are known indicators of this ransomware.