Ransomware Series: Mass File Rename to Ransomware Extension (Encryption in Progress)
Detects high-volume file rename and modification operations occurring across multiple directories, combined with the creation of files indicative of ransom notes (e.g., readme, decrypt, how-to-restore). This pattern is strongly associated with the encryption phase of a ransomware attack.
Microsoft Sentinel (KQL)
