title: Ransomware Encryption Activity
id: 35ddd011-c568-5bf7-8bc1-3c2c48cb9e01
custom_id: wf-mal-004
status: stable
level: critical
description: |
    Detects active ransomware encryption behavior. This critical alert indicates
    that ransomware is actively encrypting files on the network. Immediate
    incident response action is required.
author: WitFoo
date: 2026-02-21
tags:
    - attack.impact
    - attack.t1486
references:
    - https://attack.mitre.org/techniques/T1486/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "ransomware_encryption"
    condition: selection
fields:
    - clientIP
    - serverIP
    - fileName
    - filePath
    - userName
    - matchedLeadRules
    - severityLabel
falsepositives:
    - Legitimate bulk encryption operations (e.g., BitLocker rollout)
    - File system encryption for compliance