Ransomware-Pattern: High-Volume File Modification/Rename by Single Process (T1486)

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•4

Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.