Log source category
file_rename log source Sigma rules
2 Sigma detection rules in the library use the file_rename log source, mostly on windows. The file_rename category groups related telemetry so you can find detections that consume the same events. Open a rule to read its detection logic, MITRE ATT&CK mapping and original YAML.
2 rules
Non-DLL Extension File Renamed With DLL Extension
mediumDetects rename operations of files with non-DLL extensions to files with a DLL extension. This is often performed by malware in order to avoid initial detections based on extensions.
windows
Suspicious Appended Extension
mediumDetects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.
windows