critical SPL Windows

Mass File Modification Consistent With Ransomware

Volume and breadth together. Backup agents touch many files but few extensions; encryption touches many files across many directories and rewrites the extension.

Rule source

mass-file-encryption.spl

# Mass File Modification Consistent With Ransomware
# T1486 - Data Encrypted for Impact
# Volume and breadth together. A backup agent touches many files but few
# extensions; encryption touches many files AND rewrites the extension.

index=sysmon EventCode=11
| eval ext=lower(replace(TargetFilename, "^.*\.", ""))
| bin _time span=5m
| stats
    dc(TargetFilename)  as files,
    dc(ext)             as ext_variety,
    values(ext)         as extensions,
    dc(parent_dir)      as dirs
  by _time, Computer, Image, User
| where files > 400 AND dirs > 25
| eval verdict=case(
      files > 2000, "critical",
      files > 800,  "high",
      true(),       "medium")
| search NOT Image IN (
      "C:\\Program Files\\Veeam\\*",
      "C:\\Program Files\\Windows Defender\\*",
      "C:\\Windows\\System32\\ntoskrnl.exe")
| table _time, Computer, User, Image, files, dirs, ext_variety, verdict
| sort - files

Required telemetry

Sysmon - Event ID 11 (file create)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Backup and archival agents - allowlisted by signed image path
Large media transcoding or CAD batch jobs on engineering workstations

Validation

Encryption simulator over 3,000 lab files; threshold set from 30 days of baseline

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.