All Detections

StopAndProtect LockScreen.exe ransom display with note-content verification

avatar
Duo Tech@duotech
updated Aug 18, 2026004

Detects the LockScreen component blocking user input and displaying a full-screen StopAndProtect ransom note referencing Telegram/BTC payment.

Microsoft Sentinel (KQL)