Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Cloak – High-Rate File Rename with Ransom-Note Drop (Generic Encryptor Behavior)

Cloak Encryption / Impact Sentinel
MITRE ATT&CK
Data Encrypted for Impact
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (cloak) – no group-specific tool/TTP telemetry on file; generic encryptor-behavior detection logic
What This Detects
Cloak has no group-specific tool telemetry on file; hunting relies on the generic but reliable signal of rapid mass file renaming plus ransom-note creation across many folders on one host.
Query
let massRename = DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileRenamed"
| summarize RenameCount = count(), Folders = dcount(FolderPath) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 10m)
| where RenameCount > 200 and Folders > 5;
let ransomNote = DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName has_any ("README","HOW_TO_DECRYPT","RECOVER")
| project DeviceName, NoteTime = Timestamp, FileName;
massRename
| join kind=inner ransomNote on DeviceName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.