Potential Ransomware Activity Using LegalNotice Message

SigmaHQ Detections@sigmaHQ

•updated Aug 17, 2023•0•0•2

Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages