Mass file encryption with .SINOBI extension
This rule detects potential ransomware activity by monitoring for a high volume (exceeding 20 occurrences within a 5-minute window) of file rename, modification, or creation events associated with the '.sinobi' file extension. The logic aggregates these events by device and account to identify patterns consistent with mass file encryption, mapping to the MITRE ATT&CK T1486 (Data Encrypted for Impact) technique.
Microsoft Sentinel (KQL)
