Qilin

title: LockerGoga Ransomware Activity
id: 74db3488-fd28-480a-95aa-b7af626de068
status: stable
description: Detects LockerGoga ransomware activity via specific command line.
references:
    - https://medium.com/@malwaredancer/lockergoga-input-arguments-ipc-communication-and-others-bd4e5a7ba80a
    - https://blog.f-secure.com/analysis-of-lockergoga-ransomware/
    - https://www.carbonblack.com/blog/tau-threat-intelligence-notification-lockergoga-ransomware/
author: Vasiliy Burov, oscd.community
date: 2020-10-18
modified: 2023-02-03
tags:
    - attack.impact
    - attack.t1486
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: '-i SM-tgytutrc -s'
    condition: selection
falsepositives:
    - Unlikely
level: critical

title: AWS EC2 Disable EBS Encryption
id: 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
status: stable
description: |
  Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
  Disabling default encryption does not change the encryption status of your existing volumes.
references:
    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html
author: Sittikorn S
date: 2021-06-29
modified: 2021-08-20
tags:
    - attack.impact
    - attack.t1486
    - attack.t1565
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: ec2.amazonaws.com
        eventName: DisableEbsEncryptionByDefault
    condition: selection
falsepositives:
    - System Administrator Activities
    - DEV, UAT, SAT environment. You should apply this rule with PROD account only.
level: medium

title: Antivirus - Ransomware Signature
id: 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
status: test
description: |
    Detects a highly relevant Antivirus alert that reports ransomware.
    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
references:
    - https://www.nextron-systems.com/?s=antivirus
    - https://www.virustotal.com/gui/file/43b0f7872900bd234975a0877744554f4f355dc57505517abd1ef611e1ce6916
    - https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7
    - https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045
    - https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d
    - https://www.virustotal.com/gui/file/69fe77dd558e281621418980040e2af89a2547d377d0f2875502005ce22bc95c
    - https://www.virustotal.com/gui/file/6f0f20da34396166df352bf301b3c59ef42b0bc67f52af3d541b0161c47ede05
author: Florian Roth (Nextron Systems), Arnim Rupp
date: 2022-05-12
modified: 2026-06-15
tags:
    - attack.t1486
    - attack.impact
logsource:
    category: antivirus
detection:
    selection:
        Signature|contains:
            - 'Babuk'
            - 'Babyk'
            - 'BlackWorm'
            - 'Chaos'
            - 'Cobra'
            - 'ContiCrypt'
            - 'Crypter'
            - 'Cryptes'
            - 'Cryptor'
            - 'CylanCrypt'
            - 'DelShad'
            - 'Destructor'
            - 'Filecoder'
            - 'GandCrab'
            - 'GrandCrab'
            - 'Haperlock'
            - 'Hiddentear'
            - 'HydraCrypt'
            - 'Krypt'
            - 'Lockbit'
            - 'Locker'
            - 'Mallox'
            - 'Medusa'
            - 'Phobos'
            - 'Ransom'
            - 'Rook'
            - 'Ryuk'
            - 'Ryzerlo'
            - 'Stopcrypt'
            - 'Tescrypt'
            - 'TeslaCrypt'
            - 'WannaCry'
            - 'Xorist'
    condition: selection
falsepositives:
    - Unlikely
level: critical

title: Potential Conti Ransomware Activity
id: 689308fc-cfba-4f72-9897-796c1dc61487
status: test
description: Detects a specific command used by the Conti ransomware group
references:
    - https://news.sophos.com/en-us/2021/09/03/conti-affiliates-use-proxyshell-exchange-exploit-in-ransomware-attacks/
    - https://twitter.com/VK_Intel/status/1447795359900704769?t=Xz7vaLTvaaCZ5kHoZa6gMw&s=19
author: frack113
date: 2021-10-12
modified: 2023-02-13
tags:
    - attack.impact
    - attack.s0575
    - attack.t1486
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - '-m '
            - '-net '
            - '-size ' # Size 10 in references
            - '-nomutex '
            - '-p \\\\'
            - '$'
    condition: selection
falsepositives:
    - Unlikely
level: critical

title: WannaCry Ransomware Activity
id: 41d40bff-377a-43e2-8e1b-2e543069e079
status: test
description: Detects WannaCry ransomware activity
references:
    - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
    - https://x.com/nas_bench/status/1868639048484425963
author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
date: 2019-01-16
modified: 2025-10-18
tags:
    - attack.lateral-movement
    - attack.defense-impairment
    - attack.t1210
    - attack.discovery
    - attack.t1083
    - attack.t1222.001
    - attack.impact
    - attack.t1486
    - attack.t1490
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\tasksche.exe'
              - '\mssecsvc.exe'
              - '\taskdl.exe'
              - '\taskhsvc.exe'
              - '\taskse.exe'
              - '\111.exe'
              - '\lhdfrgui.exe'
              # - '\diskpart.exe'  # cannot be used in a rule of level critical
              - '\linuxnew.exe'
              - '\wannacry.exe'
        - Image|contains: 'WanaDecryptor'
    selection_cmd:
        CommandLine|contains: '@Please_Read_Me@.txt'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical

title: BlueSky Ransomware Artefacts
id: eee8311f-a752-44f0-bf2f-6b007db16300
status: test
description: Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.
references:
    - https://unit42.paloaltonetworks.com/bluesky-ransomware/
author: j4son
date: 2023-05-23
tags:
    - attack.impact
    - attack.t1486
    - detection.emerging-threats
logsource:
    product: windows
    service: security
detection:
    selection_access_eid:
        EventID:
            - 4663
            - 4656
    selection_access_data:
        - ObjectName|endswith: '.bluesky'
        - ObjectName|contains: 'DECRYPT FILES BLUESKY'
    selection_share_eid:
        EventID: 5145
    selection_share_data:
        - RelativeTargetName|endswith: '.bluesky'
        - RelativeTargetName|contains: 'DECRYPT FILES BLUESKY'
    condition: all of selection_access_* or all of selection_share_*
falsepositives:
    - Unknown
level: high

title: Load Of RstrtMgr.DLL By A Suspicious Process
id: b48492dc-c5ef-4572-8dff-32bc241c15c8
related:
    - id: 3669afd2-9891-4534-a626-e5cf03810a61
      type: derived
status: test
description: |
    Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
    This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
    It could also be used for anti-analysis purposes by shut downing specific processes.
references:
    - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
    - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
    - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
    - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html
author: Luc Génaux
date: 2023-11-28
tags:
    - attack.impact
    - attack.defense-impairment
    - attack.t1486
    - attack.t1685
logsource:
    category: image_load
    product: windows
detection:
    selection_img:
        - ImageLoaded|endswith: '\RstrtMgr.dll'
        - OriginalFileName: 'RstrtMgr.dll'
    selection_folders_1:
        Image|contains:
            # Note: increase coverage by adding more suspicious paths
            - ':\Perflogs\'
            - ':\Users\Public\'
            - '\Temporary Internet'
    selection_folders_2:
        - Image|contains|all:
              - ':\Users\'
              - '\Favorites\'
        - Image|contains|all:
              - ':\Users\'
              - '\Favourites\'
        - Image|contains|all:
              - ':\Users\'
              - '\Contacts\'
    condition: selection_img and 1 of selection_folders_*
falsepositives:
    - Processes related to software installation
level: high

title: Renamed Gpg.EXE Execution
id: ec0722a3-eb5c-4a56-8ab2-bf6f20708592
status: test
description: Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.
references:
    - https://securelist.com/locked-out/68960/
author: Nasreddine Bencherchali (Nextron Systems), frack113
date: 2023-08-09
tags:
    - attack.impact
    - attack.t1486
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        OriginalFileName: 'gpg.exe'
    filter_main_img:
        Image|endswith:
            - '\gpg.exe'
            - '\gpg2.exe'
    condition: selection and not 1 of filter_main_*
level: high