SG-093: Ransomware
Severity: CRITICAL
Encrypt-then-extort: recovery/shadow-copy destruction, ransom-note language, mass rename to ransomware extensions, or crypto-encryption co-located with destruction of the originals.
Fires when
- Deletes Volume Shadow Copies, Windows backups, or disables system restore (anti-recovery step before encryption)
- Contains ransom-note language demanding a cryptocurrency payment to decrypt or restore files
- Mass-renames files to a known ransomware extension (.locked, .encrypted, .wncry, etc.) across a loop or directory walk
- Uses a file-encryption call (openssl enc, gpg, AES, Fernet) together with deleting or walking the original files nearby - encrypt-then-destroy
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.