Add detection for Lynx Ransomware execution flags

rules-emerging-threats/2026/Malware/Lynx-Ransomware/proc_creation_win_malware_lynx.yml

@@ -0,0 +1,26 @@
+title: Lynx Ransomware Execution Pattern
+id: a30c7711-1b6d-49eb-9925-a4b2c0e9f039
+status: experimental
+description: |
+    Detects the execution of Lynx ransomware based on specific command line flags such as '--noprint' and '--mode fast'.
+references:
+    - https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/
+author: Swarup-Ingale
+date: 2026-06-25
+tags:
+    - attack.impact
+    - attack.t1486
+    - detection.emerging-threats
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        CommandLine|contains|all:
+            - ' --mode '
+            - ' fast'
+            - ' --noprint'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: high