Ransomware detections
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Some suspicious file types are created, typical of ransomware files.
Severity
Critical
Rule Requirement
Criteria
Action1:
actionname = "File created" AND ((FILETYPE = "ccc" OR FILETYPE = "cerber" OR FILETYPE = "crypt" OR FILETYPE = "cryptolocker" OR FILETYPE = "cryptowall" OR FILETYPE = "ecc" OR FILETYPE = "ezz" OR FILETYPE = "locky" OR FILETYPE = "micro" OR FILETYPE = "zepto" OR FILETYPE = "wnry" OR FILETYPE = "wcry" OR FILETYPE = "wcrypt"))
| timewindow 5m having COUNT >= 3
select Action1.timewindow.HOSTNAME,Action1.timewindow.MESSAGE,Action1.timewindow.USERNAME,Action1.timewindow.DOMAIN,Action1.timewindow.OBJECTNAME,Action1.timewindow.PROCESSNAME,Action1.timewindow.ACCESSLIST,Action1.timewindow.FILETYPE
Detection
Execution Mode
realtime
Log Sources
Windows
