Emerging Threathighexperimental

FunkLocker Ransomware File Creation

Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Saiprashanth PulisettiCreated Fri Aug 082c76a22b-702d-48fd-8fa9-e41e2fe203b32025

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|endswith: '.funksec'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Techniques

Other

detection.emerging-threats

Rule Metadata

Rule ID

2c76a22b-702d-48fd-8fa9-e41e2fe203b3

Status

experimental

Level

high

Type

Emerging Threat

Created

Fri Aug 08

Author

Path

rules-emerging-threats/2025/Malware/file_event_win_malware_funklocker_ransomware_extension.yml

Raw Tags

attack.impactattack.t1486detection.emerging-threats