huntrule

Windows: Detect creation of .funksec files used as FunkLocker ransomware extensions

Flags Windows file creations where the new filename ends with .funksec, consistent with FunkLocker-encrypted file naming.

FreeUnreviewedSigmahighv1
title: "Windows: Detect creation of .funksec files used as FunkLocker ransomware extensions"
id: 797b51e7-eb21-43f6-ad6f-56384de4dcd3
status: experimental
description: This rule alerts when a file creation event creates a target filename ending in .funksec. The extension is associated with how FunkLocker ransomware appends to encrypted files, which can indicate active encryption and impact. It relies on Windows file event telemetry that records the created filename.
references:
  - https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware
  - https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/file_event_win_malware_funklocker_ransomware_extension.yml
author: Saiprashanth Pulisetti ( @Prashanthblogs), Huntrule Team
date: 2025-08-08
tags:
  - attack.impact
  - attack.t1486
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: .funksec
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 2c76a22b-702d-48fd-8fa9-e41e2fe203b3
    type: derived

What it detects

This rule alerts when a file creation event creates a target filename ending in .funksec. The extension is associated with how FunkLocker ransomware appends to encrypted files, which can indicate active encryption and impact. It relies on Windows file event telemetry that records the created filename.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.