Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Detects a highly relevant Antivirus alert that reports ransomware

Ransomware create txt file in the user Desktop

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.