{
  "eventType": "LLE_FILE_DATA_WRITE_FULL",
  "rule": {
    "condition": {
      "$operation": "!imatch",
      "pattern":   "@const.ransomSystemExclusions",
      "args": [ "@event.file.path" ]
    },
    "createEvent": {
      "eventType":   "MLE_RANSOM_CANDIDATE",
      "destination": "IN",            // motorun içinde kalır
      "clone":       false,
      "data": [
        { "name": "baseType",         "value": "@const.ransomBehaviorEventBaseType.MLE_RANSOM_BEHAVIOR" },
        { "name": "process",          "value": "@event.process" },
        { "name": "processes",        "value": "@event.processes" },
        { "name": "destination",      "value": "@event.file" },
        { "name": "time",             "value": "@event.time" },
        { "name": "tickTime",         "value": "@event.tickTime" },
        { "name": "quarantineTarget", "value": "@event.file.path" }
      ]
    }
  }
}

{
  "eventType": "MLE_RANSOM_CANDIDATE",
  "rule": {
    "createEvent": {
      "eventType":   "MLE_RANSOM_EVALUATE",
      "destination": "IN",
      "clone":       false,
      "data": [
        { "name": "baseType",    "value": "@const.ransomBehaviorEventBaseType.MLE_RANSOM_BEHAVIOR" },
        { "name": "process",     "value": "@event.process" },
        { "name": "processes",   "value": "@event.processes" },
        { "name": "destination", "value": "@event.destination" },
        { "name": "source",      "value": "@event.source" },
        { "name": "time",        "value": "@event.time" },
        { "name": "tickTime",    "value": "@event.tickTime" }
      ]
    }
  }
}

"distinctCounter": {
  "basket":    "ransomFileDistinct",        // ayrı sayaç alanı (konteyner)
  "key":       "@event.process.pid",         // HER SÜREÇ AYRI SAYILIR
  "values":    [ "@event.destination.path" ], // sayılan değer: HEDEF YOLU
  "threshold": 3,                             // 3 AYRI hedef
  "window":    60000,                         // 60 saniye kayan pencere
  "flag":      "@event.RansomThresholdMet"    // sonuç buraya yazılır
}

// ENTROPY_ONE_Q24 = 2^24.  Aralık: [0, 8 * ENTROPY_ONE_Q24]
// Float'a çevirmek için: (double)sonuç / (double)ENTROPY_ONE_Q24
constexpr ULONGLONG ENTROPY_ONE_Q24 = 1ULL << 24;

ULONGLONG shannonEntropyQ24(PUCHAR buffer, size_t size)
{
    if (!buffer || size == 0) return 0;

    // 256 kovalı bayt histogramı
    ULONGLONG bkt[256] = {};
    for (size_t i = 0; i < size; i++) bkt[buffer[i]]++;

    ULONGLONG slQ24 = OwlyLog2Q24((ULONGLONG)size);        // log2(N)
    ULONGLONG wsum  = 0;
    for (ULONG i = 0; i < 256; i++)
        if (bkt[i]) wsum += bkt[i] * OwlyLog2Q24(bkt[i]);

    ULONGLONG avg  = wsum / (ULONGLONG)size;               // (1/N) * SUM n_i*log2(n_i)
    ULONGLONG eQ24 = (slQ24 > avg) ? (slQ24 - avg) : 0;   // H = log2(N) - (1/N)*SUM(...)
    if (eQ24 > c_EntMaxQ24) eQ24 = c_EntMaxQ24;   // 8 ile sınırla
    return eQ24;
}

// Extensions of user files whose encryption is treated as ransomware-relevant.
// Scopes the file-encryption candidate so extensionless / temp files do not FP.
"ransomFileExtensions": [
  "*.0", "*.0nv", "*.0rv", "*.1", "*.10", "*.10-config",
  "*.12", "*.13", "*.14", "*.15", "*.16", "*.17",
  "*.18", "*.199", "*.1cd", "*.1m", "*.20", "*.25",
  "*.3fr", "*.3gp", "*.3g2", "*.amr", "*.avi", "*.bak",
  "*.blend", "*.bmp", "*.cdr", "*.cpp", "*.cr3", "*.csv",
  "*.dbf", "*.dll", "*.doc", "*.docx", "*.dot", "*.dotx",
  "*.dwg", "*.eml", "*.enc", "*.encrypted", "*.flac", "*.gif",
  "*.gz", "*.htm", "*.html", "*.ico", "*.indd", "*.java",
  "*.jpeg", "*.jpg", "*.js", "*.json", "*.locked", "*.log",
  "*.mdb", "*.mdf", "*.mkv", "*.mov", "*.mp3", "*.mp4",
  "*.odt", "*.pdf", "*.php", "*.png", "*.ppt", "*.pptx",
  "*.psd", "*.py", "*.rar", "*.rb", "*.rtf", "*.sln",
  "*.sql", "*.tar", "*.tiff", "*.txt", "*.vhd", "*.vmdk",
  "*.wav", "*.webm", "*.webp", "*.wmv", "*.xls", "*.xlsx",
  "*.xml", "*.zip", "*.zip-o-matic", "*.zoo", "*.zst"
  // ... alfabetik, 1479 kayıt, *.0 -> *.zst
],

/*  mmap ile yapılan okuma/yazma HİÇBİR IRP_MJ_READ / IRP_MJ_WRITE
    üretmez.  NtCreateSection + NtMapViewOfSection doğrudan belleğe
    eşler.  Bu yüzden tek görünür sinyal, section edinme IRP'sidir.  */

{
  "eventType": "LLE_FILE_DATA_WRITE_FULL",
  "rule": {
    "condition": {
      "$operation": "!imatch",
      "pattern":   "@const.ransomSystemExclusions",
      "args": [ "@event.file.path" ]
    },
    "createEvent": {
      "eventType":   "MLE_RANSOM_CANDIDATE",
      "destination": "IN",            // stays inside the engine
      "clone":       false,
      "data": [
        { "name": "baseType",         "value": "@const.ransomBehaviorEventBaseType.MLE_RANSOM_BEHAVIOR" },
        { "name": "process",          "value": "@event.process" },
        { "name": "processes",        "value": "@event.processes" },
        { "name": "destination",      "value": "@event.file" },
        { "name": "time",             "value": "@event.time" },
        { "name": "tickTime",         "value": "@event.tickTime" },
        { "name": "quarantineTarget", "value": "@event.file.path" }
      ]
    }
  }
}

{
  "eventType": "MLE_RANSOM_CANDIDATE",
  "rule": {
    "createEvent": {
      "eventType":   "MLE_RANSOM_EVALUATE",
      "destination": "IN",
      "clone":       false,
      "data": [
        { "name": "baseType",    "value": "@const.ransomBehaviorEventBaseType.MLE_RANSOM_BEHAVIOR" },
        { "name": "process",     "value": "@event.process" },
        { "name": "processes",   "value": "@event.processes" },
        { "name": "destination", "value": "@event.destination" },
        { "name": "source",      "value": "@event.source" },
        { "name": "time",        "value": "@event.time" },
        { "name": "tickTime",    "value": "@event.tickTime" }
      ]
    }
  }
}

"distinctCounter": {
  "basket":    "ransomFileDistinct",        // separate counter space (container)
  "key":       "@event.process.pid",         // EACH PROCESS IS COUNTED SEPARATELY
  "values":    [ "@event.destination.path" ], // counted value: TARGET PATH
  "threshold": 3,                             // 3 AYRI hedef
  "window":    60000,                         // 60 saniye kayan pencere
  "flag":      "@event.RansomThresholdMet"    // result is written here
}

// ENTROPY_ONE_Q24 = 2^24.  Range: [0, 8 * ENTROPY_ONE_Q24]
// To convert to float: (double)result / (double)ENTROPY_ONE_Q24
constexpr ULONGLONG ENTROPY_ONE_Q24 = 1ULL << 24;

ULONGLONG shannonEntropyQ24(PUCHAR buffer, size_t size)
{
    if (!buffer || size == 0) return 0;

    // 256-bucket byte histogram
    ULONGLONG bkt[256] = {};
    for (size_t i = 0; i < size; i++) bkt[buffer[i]]++;

    ULONGLONG slQ24 = OwlyLog2Q24((ULONGLONG)size);        // log2(N)
    ULONGLONG wsum  = 0;
    for (ULONG i = 0; i < 256; i++)
        if (bkt[i]) wsum += bkt[i] * OwlyLog2Q24(bkt[i]);

    ULONGLONG avg  = wsum / (ULONGLONG)size;               // (1/N) * SUM n_i*log2(n_i)
    ULONGLONG eQ24 = (slQ24 > avg) ? (slQ24 - avg) : 0;   // H = log2(N) - (1/N)*SUM(...)
    if (eQ24 > c_EntMaxQ24) eQ24 = c_EntMaxQ24;   // clamp to 8
    return eQ24;
}

// Extensions of user files whose encryption is treated as ransomware-relevant.
// Scopes the file-encryption candidate so extensionless / temp files do not FP.
"ransomFileExtensions": [
  "*.0", "*.0nv", "*.0rv", "*.1", "*.10", "*.10-config",
  "*.12", "*.13", "*.14", "*.15", "*.16", "*.17",
  "*.18", "*.199", "*.1cd", "*.1m", "*.20", "*.25",
  "*.3fr", "*.3gp", "*.3g2", "*.amr", "*.avi", "*.bak",
  "*.blend", "*.bmp", "*.cdr", "*.cpp", "*.cr3", "*.csv",
  "*.dbf", "*.dll", "*.doc", "*.docx", "*.dot", "*.dotx",
  "*.dwg", "*.eml", "*.enc", "*.encrypted", "*.flac", "*.gif",
  "*.gz", "*.htm", "*.html", "*.ico", "*.indd", "*.java",
  "*.jpeg", "*.jpg", "*.js", "*.json", "*.locked", "*.log",
  "*.mdb", "*.mdf", "*.mkv", "*.mov", "*.mp3", "*.mp4",
  "*.odt", "*.pdf", "*.php", "*.png", "*.ppt", "*.pptx",
  "*.psd", "*.py", "*.rar", "*.rb", "*.rtf", "*.sln",
  "*.sql", "*.tar", "*.tiff", "*.txt", "*.vhd", "*.vmdk",
  "*.wav", "*.webm", "*.webp", "*.wmv", "*.xls", "*.xlsx",
  "*.xml", "*.zip", "*.zip-o-matic", "*.zoo", "*.zst"
  // ... alphabetical, 1479 entries, *.0 -> *.zst
],

/*  Reads/writes via mmap produce NO IRP_MJ_READ / IRP_MJ_WRITE.
    NtCreateSection + NtMapViewOfSection map directly into
    memory.  So the only visible signal is the section acquisition IRP.  */