Lynx ransomware execution flagged by Windows command-line flags

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule identifies likely Lynx ransomware execution by matching Windows process creation command lines containing the flags "--mode fast" and "--noprint". These command-line parameters are characteristic of how the malware may be run, making this a high-signal indicator for ransomware activity. It relies on process creation telemetry that includes full command-line strings.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Ransomware Encryption Extension x2anylock

Malicious Fivehands Go Encryptor Execution via Command Line Flags

Malicious SafePay Ransomware Encryptor Command-Line Execution

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

Malicious GigaWiper Ransomware File Extension .candy

Malicious Forced BitLocker Encryption for Extortion (via process_creation)

Malicious Volume Shadow Copy Deletion via Vssadmin

Malicious CACTUS Ransomware Note and Encrypted File Artifacts (via file_event)

Malicious Macaw Ransom Note or Encrypted File Written (via file_event)

Lynx ransomware execution flagged by Windows command-line flags

Pivot detection · T1486 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

lynx-ransomware-execution-flagged-by-windows-command-line-flags-a30c7711

title: Lynx ransomware execution flagged by Windows command-line flags
id: 14db2ea7-6502-4274-91da-679a78295ec0
status: experimental
description: This rule identifies likely Lynx ransomware execution by matching Windows process creation command lines containing the flags "--mode fast" and "--noprint". These command-line parameters are characteristic of how the malware may be run, making this a high-signal indicator for ransomware activity. It relies on process creation telemetry that includes full command-line strings.
references:
  - https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Lynx-Ransomware/proc_creation_win_malware_lynx.yml
author: Swarup-Ingale, Huntrule Team
date: 2026-06-25
tags:
  - attack.impact
  - attack.t1486
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - " --mode "
      - " fast"
      - " --noprint"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a30c7711-1b6d-49eb-9925-a4b2c0e9f039
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL