FunkLocker Ransomware File Creation

calendar Sep 22, 2025 · attack.t1486 detection.emerging-threats  ·
Share on: linkedin copy

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

Sigma rule (View on GitHub)

 1title: FunkLocker Ransomware File Creation
 2id: 2c76a22b-702d-48fd-8fa9-e41e2fe203b3
 3status: experimental
 4description: Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.
 5references:
 6    - https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware
 7    - https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware
 8author: Saiprashanth Pulisetti ( @Prashanthblogs)
 9date: 2025-08-08
10tags:
11    - attack.t1486
12    - detection.emerging-threats
13logsource:
14    category: file_event
15    product: windows
16detection:
17    selection:
18        TargetFilename|endswith: '.funksec'
19    condition: selection
20falsepositives:
21    - Unlikely
22level: high

References

  • Funksec Ransomware

    Funksec (aka Funklocker) is another double-extortion ransomware actor that surfaced in late 2024 and allegedly claimed multiple organizations as victims.


    Read More

  • FunkLocker (FunkSec) Ransomware

    What kind of malware is FunkLocker (FunkSec)? FunkLocker, also known as FunkSec, is a ransomware-type program. It operates by encrypting files and demanding ransoms for the decryption. After we exe...


    Read More

Related rules

to-top