DragonForce ChaCha8 mass file encryption burst to .df_win extension

Arnold Chan@slaz

•updated Sep 9, 2026•0•0•1

Detects high-frequency file creation, modification, or renaming activity involving files with the specific '.df_win' extension, likely indicative of mass encryption activity or automated ransomware behavior. The rule excludes known backup and security software processes to reduce noise.