huntrule

Lynx ransomware execution flagged by Windows command-line flags

Flags Windows processes whose command lines include "--mode fast" and "--noprint" associated with Lynx ransomware execution.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Swarup-Ingale (SigmaHQ), DRL 1.1
Published
2026-06-25
Updated
2026-10-19
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies likely Lynx ransomware execution by matching Windows process creation command lines containing the flags "--mode fast" and "--noprint". These command-line parameters are characteristic of how the malware may be run, making this a high-signal indicator for ransomware activity. It relies on process creation telemetry that includes full command-line strings.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange
Malicious Ransomware Encryption Extension x2anylock
Malicious Fivehands Go Encryptor Execution via Command Line Flags
Malicious SafePay Ransomware Encryptor Command-Line Execution
Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags
Malicious GigaWiper Ransomware File Extension .candy
Malicious Forced BitLocker Encryption for Extortion (via process_creation)
Malicious Volume Shadow Copy Deletion via Vssadmin
Malicious CACTUS Ransomware Note and Encrypted File Artifacts (via file_event)
Malicious Macaw Ransom Note or Encrypted File Written (via file_event)
Lynx ransomware execution flagged by Windows command-line flags
Pivot detection · T1486 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.