Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

RansomHouse – Dual-Key Encryption Pattern: Mass Rename with Two Ransom Notes

Ransomhouse Encryption / Impact Sentinel
MITRE ATT&CK
Data Encrypted for Impact
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (ransomhouse) – no group-specific tool/TTP telemetry on file; inference from the group's own described dual-key architecture
What This Detects
RansomHouse has moved to a multi-layered, dual-key encryption architecture per its own leak-site messaging; a reliable if generic signal is rapid mass file renaming paired with more than one distinct ransom-note filename dropped in the same operation.
Query
let massRename = DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileRenamed"
| summarize RenameCount = count(), Folders = dcount(FolderPath) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 10m)
| where RenameCount > 200 and Folders > 5;
let notes = DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName has_any ("README","HOW_TO_RESTORE","DECRYPT")
| summarize NoteVariants = dcount(FileName) by DeviceName
| where NoteVariants >= 2;
massRename
| join kind=inner notes on DeviceName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.