Windows File Creation of .funksec Ransom Note Extension

Flags Windows file creations where the new filename ends with .funksec, consistent with FunkLocker-encrypted file naming.

FreeReviewedSigma · High · v5

Product: windows
Category: file_event
Author: Saiprashanth Pulisetti ( @Prashanthblogs) (SigmaHQ), DRL 1.1
Published: 2025-08-08
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags Windows file creation events where the target filename ends with the .funksec extension. Appending a distinctive extension to encrypted files is a common ransomware behavior that enables easy identification of affected data and can support extortion workflows. Detection relies on file event telemetry that captures the created/handled filename and allows suffix matching.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Suspicious CyberLock Ransomware Encrypted File Creation

Rhysida Ransomware Encrypted File Extension Created

Phobos 8Base Ransomware Encrypted File Extension Created

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

Possible Akira Ransomware Note or Encrypted Extension Creation

Malicious Storm-2603 Ransom Note File Creation

Possible Ransomware Note or Encrypted File Extension Creation

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

Windows File Creation of .funksec Ransom Note Extension

Pivot detection · T1486 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-creation-of-funksec-files-used-as-funklocker-ransomware-extension-2c76a22b

title: Windows File Creation of .funksec Ransom Note Extension
id: 797b51e7-eb21-43f6-ad6f-56384de4dcd3
status: experimental
description: This rule flags Windows file creation events where the target filename ends with the .funksec extension. Appending a distinctive extension to encrypted files is a common ransomware behavior that enables easy identification of affected data and can support extortion workflows. Detection relies on file event telemetry that captures the created/handled filename and allows suffix matching.
references:
  - https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware
  - https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/file_event_win_malware_funklocker_ransomware_extension.yml
author: Saiprashanth Pulisetti ( @Prashanthblogs), Huntrule Team
date: 2025-08-08
tags:
  - attack.impact
  - attack.t1486
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: .funksec
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 2c76a22b-702d-48fd-8fa9-e41e2fe203b3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL