Every published rule

Windows: BlueSky ransomware-related file and share access events

Alerts on Windows file/share access involving .bluesky and "DECRYPT FILES BLUESKY" artifact naming tied to BlueSky activity.

Windows: Rorschach execution indicator via critical command-line pattern

Windows process creation events with certain system utilities and a "11111111" command-line marker are flagged as ransomware execution activity.

Windows Registry Ransom Note Keyword Changes in LegalNoticeCaption/Text

Alerts on registry changes to Windows legal notice caption/text containing ransomware-style keywords.

Antivirus ransomware signature match (Babuk, Lockbit, Ryuk, WannaCry)

Flags antivirus ransomware detections when the alert signature contains known ransomware family name strings.

Windows Process Command-Line Indicators of BlackByte Ransomware Activity

Flags Windows process creation command-line patterns consistent with BlackByte ransomware techniques.

BlackByte ransomware Registry Set Persistence and Privilege Changes (Windows)

Alerts on BlackByte-specific Windows registry value changes to DWORD 1 across three predefined keys.

Windows: .txt Created on User Desktop via cmd.exe

Flags cmd.exe creating .txt files under user Desktop, a common ransomware-style artifact placement pattern.

Microsoft 365 Cloud App Security - Potential Ransomware Activity Alerts on File Upload

Flags successful Microsoft Cloud App Security reports of potential ransomware-related file uploads in Microsoft 365.

Windows process creation patterns associated with DarkSide ransomware helpers

Detects Windows process creation consistent with DarkSide ransomware helper execution using encoded command-line content.

LockerGoga Ransomware Indicators in Windows Process Command Line

Flags Windows processes with a specific LockerGoga-style command-line argument pattern.

Windows Process Creation Indicators for Snatch Ransomware Word Document Droppers

Alerts on Windows process command lines showing instant safe-mode shutdown/reboot and stopping SuperBackupMan service.

Windows Process Creation: Maze Ransomware Doc Dropper and Shadow Copy Deletion Indicators

Alerts on Word-to-temp execution followed by wmic shadowcopy deletion consistent with Maze-style ransomware droppers.

Windows Process Execution Indicative of Ryuk-Style Ransomware Behavior

Flags suspicious Windows process command lines combining autorun persistence, public staging, file backup wiping, and service stoppage behavior.

Windows Application Logs: Match Antivirus Signature and Malware Keyword Hits

Alerts on Windows application log lines containing known AV signatures and malware keywords, excluding some anti-ransomware/keygen/crack terms.