BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//Allsikt//Article Deadline//EN
CALSCALE:GREGORIAN
METHOD:PUBLISH
BEGIN:VEVENT
UID:0c2a9c2d7a22977bae9d517687b06fe8ced26753@allsikt.tech
DTSTAMP:20260721T223006Z
DTSTART;VALUE=DATE:20260721
DTEND;VALUE=DATE:20260722
SUMMARY:New GhostLock tool abuses Windows API to block file access
DESCRIPTION:Implement SIEM queries and NDR detection rules to monitor for excessive exclusive file opens on SMB shares.\n\nSource: Bleeping Computer\nOpen: https://allsikt.se/article/new-ghostlock-tool-abuses-windows-api-to-block-file-access-198600d2
URL:https://allsikt.se/article/new-ghostlock-tool-abuses-windows-api-to-block-file-access-198600d2
STATUS:CONFIRMED
TRANSP:TRANSPARENT
END:VEVENT
END:VCALENDAR