Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

KillSec – High-Rate File Rename with Ransom-Note Drop Across Multiple Shares

Killsec Encryption / Impact Sentinel
MITRE ATT&CK
Data Encrypted for Impact
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (killsec) – no group-specific tool/TTP telemetry on file; generic encryptor-behavior detection logic
What This Detects
KillSec's encryptor is unsophisticated compared to top-tier RaaS families (no BYOVD/EDR-kill chain on file) – hunting relies on the generic but reliable signal of rapid mass file renaming plus ransom-note creation across many folders on one host.
Query
let massRename = DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileRenamed"
| summarize RenameCount = count(), Folders = dcount(FolderPath) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 10m)
| where RenameCount > 200 and Folders > 5;
let ransomNote = DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName has_any ("README","DECRYPT","How_to_restore","RECOVER")
| project DeviceName, NoteTime = Timestamp, FileName;
massRename
| join kind=inner ransomNote on DeviceName
| project DeviceName, InitiatingProcessAccountName, RenameCount, Folders, NoteTime, FileName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.