Windows File Creation of .funksec Ransom Note Extension

Flags Windows file creations where the new filename ends with .funksec, consistent with FunkLocker-encrypted file naming.

FreeReviewedSigma · High · v5

Product: windows
Category: file_event
Author: Saiprashanth Pulisetti ( @Prashanthblogs) (SigmaHQ), DRL 1.1
Published: 2025-08-08
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags Windows file creation events where the target filename ends with the .funksec extension. Appending a distinctive extension to encrypted files is a common ransomware behavior that enables easy identification of affected data and can support extortion workflows. Detection relies on file event telemetry that captures the created/handled filename and allows suffix matching.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)

Malicious Ransomware Encryption Extension x2anylock

Malicious Fivehands Go Encryptor Execution via Command Line Flags

Malicious SafePay Ransomware Encryptor Command-Line Execution

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

Malicious GigaWiper Ransomware File Extension .candy

Malicious Forced BitLocker Encryption for Extortion (via process_creation)

Malicious Volume Shadow Copy Deletion via Vssadmin

Malicious CACTUS Ransomware Note and Encrypted File Artifacts (via file_event)

Windows File Creation of .funksec Ransom Note Extension

Pivot detection · T1486 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-creation-of-funksec-files-used-as-funklocker-ransomware-extension-2c76a22b

title: Windows File Creation of .funksec Ransom Note Extension
id: 797b51e7-eb21-43f6-ad6f-56384de4dcd3
status: experimental
description: This rule flags Windows file creation events where the target filename ends with the .funksec extension. Appending a distinctive extension to encrypted files is a common ransomware behavior that enables easy identification of affected data and can support extortion workflows. Detection relies on file event telemetry that captures the created/handled filename and allows suffix matching.
references:
  - https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware
  - https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/file_event_win_malware_funklocker_ransomware_extension.yml
author: Saiprashanth Pulisetti ( @Prashanthblogs), Huntrule Team
date: 2025-08-08
tags:
  - attack.impact
  - attack.t1486
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: .funksec
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 2c76a22b-702d-48fd-8fa9-e41e2fe203b3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL