File creation of ransomware extensions and notes

[sduff]

It can be challenging to detect ransomware activity using the existing sysmon configuration. Rather than look for excessive numbers of file writes, the most common ransomware artifacts, including file extensions and ransomware notes, have been included in the file creation stanza. They can be included as two separate files, either notes on ransomware extensions.

[elhoim]

Hello @olafhartong,

I like this idea, any specific reason why it was not included? Do you fear performance issues?