Security Operations
Alert Investigation
🔎
❓

Multiple files encrypted with unknown extension

Critical New Ransomware
🚨 Open Incident INC-01002
Alert details
Alert IDda637912300003
Created2026-08-17 20:07 UTC
Detection source-
Threat family-
SourceDemo
Entities
Device corp-srv-file01 Medium riskMedium exposure
Usersvc-backup@propera.local
Related incidentINC-01002
MITRE ATT&CK
T1486 T1490
Evidence
File
Encrypted file created
D:\Shares\Finance\finance_q3.xlsx.lockbit
Process
Encryption process
encryptor.exe --target D:\Shares
C:\Windows\Temp\encryptor.exe
Registry
Shadow copy deletion (vssadmin)
vssadmin.exe delete shadows /all /quiet