[WINDOWS-MALWARE] Malware (ransomware) encoded file extension detected (.enciphered)

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-MALWARE] Malware (ransomware) encoded file extension detected (.enciphered)"; program:*Security*; json_map:"event_id",".EventID"; json_map:"username",".Computer"; json_map:"message",".RenderedDescription"; event_id:4663,567,5145; content:".enciphered "; nocase; after: track by_username, count 25, seconds 3600; threshold: type suppress, track by_username, count 25, seconds 3600; classtype:ransomware; sid:5009029; metadata: created_on 2022_11_22, old_sid 5006953; rev:2;)