title: Ransomware Download Indicator
id: 11444b32-1bd8-56d1-817f-e9a82457cf64
custom_id: wf-mal-003
status: stable
level: critical
description: |
    Detects ransomware payload download activity identified by WitFoo's
    enrichment engine. This is the initial delivery phase of a ransomware
    attack chain, before encryption begins.
author: WitFoo
date: 2026-02-21
tags:
    - attack.impact
    - attack.t1486
    - attack.initial_access
references:
    - https://attack.mitre.org/techniques/T1486/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "ransomware_download"
    condition: selection
fields:
    - clientIP
    - serverIP
    - fileName
    - fileHash
    - uri
    - matchedLeadRules
    - severityLabel
falsepositives:
    - Ransomware simulation tools (e.g., KnowBe4 RanSim)
    - Security awareness training exercises