Mass Ransom Note Drop Across Directories (Ransomware Impact)
Detects the creation of files commonly associated with ransomware notes (e.g., README.txt, HOW_TO_DECRYPT.txt) across multiple directories, which is a strong indicator of the impact phase where files have been encrypted and the adversary is providing recovery instructions.
Sigma
