Gunra ransom note (R3ADM3.txt) drop and exact negotiation email address match
Detects the drop of Gunra's static ransom note file R3ADM3.txt matched by exact filename and content signature, and exact-match usage of known Gunra ransom-negotiation email addresses.
Microsoft Sentinel (KQL)

