Detecting Ransom Note Creation Across Directories

Ransom notes are written into each directory the encryptor processes, so one process creates the same file name hundreds or thousands of times across many folders. Note names change between families and builds, and vary per victim, which makes name lists brittle. A pattern keyed on repetition and spread catches notes you have never seen before.

Signals at a Glance

Same Name, Many Folders

The generic hunt counts distinct directories per file name per process. A genuine note shows one name in dozens of directories from one process, created within minutes. This does not depend on the note name, so it survives renaming across builds:

// KQL - same file name created in many directories by one process
DeviceFileEvents
| where Timestamp > ago(1h)
| where ActionType == "FileCreated"
| where FileName endswith ".txt" or FileName endswith ".html" or FileName endswith ".hta"
| summarize dirs=dcount(FolderPath), creates=count(),
            first=min(Timestamp), last=max(Timestamp)
          by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, FileName
| where dirs > 25
| extend durationMin = datetime_diff('minute', last, first)
| where durationMin <= 30
| order by dirs desc
// tune/validate: exclude installers, indexers and your backup agents.

In Splunk with Sysmon, the same idea works on event code 11 and can be extended with a rename-burst join to confirm encryption is happening in the same window:

index=sysmon EventCode=11 (TargetFilename="*.txt" OR TargetFilename="*.html" OR TargetFilename="*.hta")
| rex field=TargetFilename "(?<dir>.*)[\\/](?<fname>[^\\/]+)$"
| bin _time span=10m
| stats dc(dir) as dirs count by host, Image, fname, _time
| where dirs > 25
| sort - dirs
# tune/validate: join to your rename-burst search on host and Image for higher fidelity.

Corroboration

• Wallpaper changes are a common secondary effect. A registry write to the desktop wallpaper value from a process other than the shell or settings app, shortly after a note burst, strengthens the case.
• Note creation usually accompanies or follows encryption, so treat it as a confirmation signal and a scoping aid, not your first line. It tells you which directories were reached.
• Preserve a sample note: it carries the group’s contact details and a victim identifier that your incident responders and negotiators will need.
• Do not alert on the filename alone. Lists of known note names are useful enrichment for attribution, but any family can rename its note in the next build.