Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

KillSec – High-Rate File Rename with Ransom-Note Drop Across Multiple Shares

Killsec Encryption / Impact Sentinel
MITRE ATT&CK
Data Encrypted for Impact
Data Source
DeviceFileEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group profile (killsec) – no group-specific tool/TTP telemetry on file; generic encryptor-behavior detection logic
What This Detects
KillSec's encryptor is unsophisticated compared to top-tier RaaS families (no BYOVD/EDR-kill chain on file) – hunting relies on the generic but reliable signal of rapid mass file renaming plus ransom-note creation across many folders on one host.
Query
let massRename = DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileRenamed"
| summarize RenameCount = count(), Folders = dcount(FolderPath) by DeviceName, InitiatingProcessAccountName, bin(Timestamp, 10m)
| where RenameCount > 200 and Folders > 5;
let ransomNote = DeviceFileEvents
| where Timestamp > ago(1d)
| where FileName has_any ("README","DECRYPT","How_to_restore","RECOVER")
| project DeviceName, NoteTime = Timestamp, FileName;
massRename
| join kind=inner ransomNote on DeviceName
| project DeviceName, InitiatingProcessAccountName, RenameCount, Folders, NoteTime, FileName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.