Windows: BlueSky ransomware-related file and share access events

Alerts on Windows file/share access involving .bluesky and "DECRYPT FILES BLUESKY" artifact naming tied to BlueSky activity.

FreeReviewedSigma · High · v5

Product: windows
Service: security
Author: j4son (SigmaHQ), DRL 1.1
Published: 2023-05-23
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags Windows file and share access events where the object name or relative target name matches BlueSky ransomware naming patterns, including files ending with .bluesky or containing the text "DECRYPT FILES BLUESKY". Such artifacts can indicate an active or previous encryption/decryption phase attempted by ransomware. It relies on Windows security telemetry including file access auditing events (4663, 4656) and share access events (5145).

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious JADEPUFFER Lockd Encryptor Execution

Suspicious Mass Locked Extension File Creation by Ransomware

Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)

Malicious Ransomware Encryption Extension x2anylock

Malicious Fivehands Go Encryptor Execution via Command Line Flags

Malicious SafePay Ransomware Encryptor Command-Line Execution

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

Malicious GigaWiper Ransomware File Extension .candy

Malicious Forced BitLocker Encryption for Extortion (via process_creation)

Windows: BlueSky ransomware-related file and share access events

Pivot detection · T1486 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-access-to-bluesky-files-and-shares-used-in-bluesky-ransomware-artifacts-eee8311f

title: "Windows: BlueSky ransomware-related file and share access events"
id: d13d05d5-5220-4c96-a1e1-3412ace7f015
status: test
description: This rule flags Windows file and share access events where the object name or relative target name matches BlueSky ransomware naming patterns, including files ending with .bluesky or containing the text "DECRYPT FILES BLUESKY". Such artifacts can indicate an active or previous encryption/decryption phase attempted by ransomware. It relies on Windows security telemetry including file access auditing events (4663, 4656) and share access events (5145).
references:
  - https://unit42.paloaltonetworks.com/bluesky-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/BlueSky-Ransomware/win_security_malware_bluesky_ransomware_files_indicators.yml
author: j4son, Huntrule Team
date: 2023-05-23
tags:
  - attack.impact
  - attack.t1486
  - detection.emerging-threats
logsource:
  product: windows
  service: security
detection:
  selection_access_eid:
    EventID:
      - 4663
      - 4656
  selection_access_data:
    - ObjectName|endswith: .bluesky
    - ObjectName|contains: DECRYPT FILES BLUESKY
  selection_share_eid:
    EventID: 5145
  selection_share_data:
    - RelativeTargetName|endswith: .bluesky
    - RelativeTargetName|contains: DECRYPT FILES BLUESKY
  condition: all of selection_access_* or all of selection_share_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: eee8311f-a752-44f0-bf2f-6b007db16300
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL