Possible ransomware activities
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Multiple file modifications are detected soon after a new process creation, typical of ransomware attacks.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "null" Action2: actionname = "File modified" AND USERNAME = Action1.USERNAME AND HOSTNAME = Action1.HOSTNAME AND PROCESSNAME = Action1.PROCESSNAME | timewindow 15m | groupby HOSTNAME | groupby USERNAME | groupby PROCESSNAME having COUNT > 15 sequence:Action1 followedby Action2 within 5m select Action2.timewindow.HOSTNAME,Action2.timewindow.MESSAGE,Action2.timewindow.USERNAME,Action2.timewindow.DOMAIN,Action2.timewindow.OBJECTNAME,Action2.timewindow.PROCESSNAME,Action2.timewindow.ACCESSLIST
Detection
Execution Mode
realtime
Log Sources
Windows
