BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Allsikt//Article Deadline//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
BEGIN:VEVENT
UID:06ed7c6adbb5b426e8b171d23a9c0d72bb3eab45@allsikt.tech
DTSTAMP:20260728T140315Z
DTSTART;VALUE=DATE:20260728
DTEND;VALUE=DATE:20260729
SUMMARY:New GhostLock tool abuses Windows API to block file access
DESCRIPTION:Implement SIEM queries and NDR detection rules to monitor for excessive exclusive file opens on SMB shares.\n\nSource: Bleeping Computer\nOpen: https://www.allsikt.se/article/new-ghostlock-tool-abuses-windows-api-to-block-file-access-198600d2
URL:https://www.allsikt.se/article/new-ghostlock-tool-abuses-windows-api-to-block-file-access-198600d2
STATUS:CONFIRMED
TRANSP:TRANSPARENT
END:VEVENT
END:VCALENDAR