DragonForce ransomware mass rename to .df_win extension
Detects high volumes of file renaming activities involving files with the .df_win extension. This pattern is often indicative of ransomware-like behavior where mass renaming occurs as part of an encryption process, impacting multiple directories.
Microsoft Sentinel (KQL)
