Antivirus Ransomware Detection — Sigma Rule

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems), Arnim Rupp. Source status: test; severity: critical. Source dates: 2022-05-12 / 2024-11-02.

{
  "category": "antivirus"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 495145d9b413f68d1a3a26fa7215deee1dc8c8dcb839ccb714175ee78673fca0

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Antivirus Ransomware Detection
id: 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
status: test
description: |
    Detects a highly relevant Antivirus alert that reports ransomware.
    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
references:
    - https://www.nextron-systems.com/?s=antivirus
    - https://www.virustotal.com/gui/file/43b0f7872900bd234975a0877744554f4f355dc57505517abd1ef611e1ce6916
    - https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7
    - https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045
    - https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d
    - https://www.virustotal.com/gui/file/69fe77dd558e281621418980040e2af89a2547d377d0f2875502005ce22bc95c
    - https://www.virustotal.com/gui/file/6f0f20da34396166df352bf301b3c59ef42b0bc67f52af3d541b0161c47ede05
author: Florian Roth (Nextron Systems), Arnim Rupp
date: 2022-05-12
modified: 2024-11-02
tags:
    - attack.t1486
    - attack.impact
logsource:
    category: antivirus
detection:
    selection:
        Signature|contains:
            - 'BlackWorm'
            - 'Chaos'
            - 'Cobra'
            - 'ContiCrypt'
            - 'Crypter'
            - 'CRYPTES'
            - 'Cryptor'
            - 'CylanCrypt'
            - 'DelShad'
            - 'Destructor'
            - 'Filecoder'
            - 'GandCrab'
            - 'GrandCrab'
            - 'Haperlock'
            - 'Hiddentear'
            - 'HydraCrypt'
            - 'Krypt'
            - 'Lockbit'
            - 'Locker'
            - 'Mallox'
            - 'Phobos'
            - 'Ransom'
            - 'Ryuk'
            - 'Ryzerlo'
            - 'Stopcrypt'
            - 'Tescrypt'
            - 'TeslaCrypt'
            - 'WannaCry'
            - 'Xorist'
    condition: selection
falsepositives:
    - Unlikely
level: critical

Original YAML and metadata in JSON

False positives

• Unlikely

Source references

• https://www.nextron-systems.com/?s=antivirus
• https://www.virustotal.com/gui/file/43b0f7872900bd234975a0877744554f4f355dc57505517abd1ef611e1ce6916
• https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7
• https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045
• https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d
• https://www.virustotal.com/gui/file/69fe77dd558e281621418980040e2af89a2547d377d0f2875502005ce22bc95c
• https://www.virustotal.com/gui/file/6f0f20da34396166df352bf301b3c59ef42b0bc67f52af3d541b0161c47ede05