Lynx Ransomware Execution Pattern

calendar Oct 19, 2026 · attack.impact attack.t1486 detection.emerging-threats  ·
Share on: linkedin copy

Detects the execution of Lynx ransomware based on specific command line flags such as '--noprint' and '--mode fast'.

Sigma rule (View on GitHub)

 1title: Lynx Ransomware Execution Pattern
 2id: a30c7711-1b6d-49eb-9925-a4b2c0e9f039
 3status: experimental
 4description: |
 5        Detects the execution of Lynx ransomware based on specific command line flags such as '--noprint' and '--mode fast'.
 6references:
 7    - https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/
 8author: Swarup-Ingale
 9date: 2026-06-25
10tags:
11    - attack.impact
12    - attack.t1486
13    - detection.emerging-threats
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection:
19        CommandLine|contains|all:
20            - ' --mode '
21            - ' fast'
22            - ' --noprint'
23    condition: selection
24falsepositives:
25    - Unlikely
26level: high

References

Related rules

to-top