Skip to content
Threat Feed
Subscribe

Tag

File-Modification

2 briefs RSS
high advisory

Detection of Common Ransomware File Extension Modifications

This analytic identifies ransomware activity by detecting file creation or modification events on endpoint filesystems where the resulting file extensions match known ransomware patterns, potentially leading to significant data loss and operational disruption.

ransomware endpoint-detection file-modification impact Rhysida Ransomware Prestige Ransomware LockBit Ransomware Medusa Ransomware +7
1r 1t
medium advisory

Potential Persistence via Mandatory User Profile Modification

Adversaries may abuse Windows mandatory profiles by dropping a malicious NTUSER.MAN file containing pre-populated persistence-related registry keys to establish persistence, which can evade traditional registry-based monitoring.

Elastic Defend persistence windows mandatory-profile file-modification
2r 2t