Windows: BlueSky ransomware-related file and share access events

Alerts on Windows file/share access involving .bluesky and "DECRYPT FILES BLUESKY" artifact naming tied to BlueSky activity.

FreeReviewedSigma · High · v5

Product: windows
Service: security
Author: j4son (SigmaHQ), DRL 1.1
Published: 2023-05-23
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags Windows file and share access events where the object name or relative target name matches BlueSky ransomware naming patterns, including files ending with .bluesky or containing the text "DECRYPT FILES BLUESKY". Such artifacts can indicate an active or previous encryption/decryption phase attempted by ransomware. It relies on Windows security telemetry including file access auditing events (4663, 4656) and share access events (5145).

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Suspicious CyberLock Ransomware Encrypted File Creation

Rhysida Ransomware Encrypted File Extension Created

Phobos 8Base Ransomware Encrypted File Extension Created

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

Possible Akira Ransomware Note or Encrypted Extension Creation

Malicious Storm-2603 Ransom Note File Creation

Possible Ransomware Note or Encrypted File Extension Creation

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

Windows: BlueSky ransomware-related file and share access events

Pivot detection · T1486 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-access-to-bluesky-files-and-shares-used-in-bluesky-ransomware-artifacts-eee8311f

title: "Windows: BlueSky ransomware-related file and share access events"
id: d13d05d5-5220-4c96-a1e1-3412ace7f015
status: test
description: This rule flags Windows file and share access events where the object name or relative target name matches BlueSky ransomware naming patterns, including files ending with .bluesky or containing the text "DECRYPT FILES BLUESKY". Such artifacts can indicate an active or previous encryption/decryption phase attempted by ransomware. It relies on Windows security telemetry including file access auditing events (4663, 4656) and share access events (5145).
references:
  - https://unit42.paloaltonetworks.com/bluesky-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/BlueSky-Ransomware/win_security_malware_bluesky_ransomware_files_indicators.yml
author: j4son, Huntrule Team
date: 2023-05-23
tags:
  - attack.impact
  - attack.t1486
  - detection.emerging-threats
logsource:
  product: windows
  service: security
detection:
  selection_access_eid:
    EventID:
      - 4663
      - 4656
  selection_access_data:
    - ObjectName|endswith: .bluesky
    - ObjectName|contains: DECRYPT FILES BLUESKY
  selection_share_eid:
    EventID: 5145
  selection_share_data:
    - RelativeTargetName|endswith: .bluesky
    - RelativeTargetName|contains: DECRYPT FILES BLUESKY
  condition: all of selection_access_* or all of selection_share_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: eee8311f-a752-44f0-bf2f-6b007db16300
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL