Ransomware detections
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Some suspicious file types are created, typical of ransomware files.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "File created" AND ((FILETYPE = "ccc" OR FILETYPE = "cerber" OR FILETYPE = "crypt" OR FILETYPE = "cryptolocker" OR FILETYPE = "cryptowall" OR FILETYPE = "ecc" OR FILETYPE = "ezz" OR FILETYPE = "locky" OR FILETYPE = "micro" OR FILETYPE = "zepto" OR FILETYPE = "wnry" OR FILETYPE = "wcry" OR FILETYPE = "wcrypt")) | timewindow 5m having COUNT > 3 select Action1.timewindow.HOSTNAME,Action1.timewindow.MESSAGE,Action1.timewindow.USERNAME,Action1.timewindow.DOMAIN,Action1.timewindow.OBJECTNAME,Action1.timewindow.PROCESSNAME,Action1.timewindow.ACCESSLIST
Detection
Execution Mode
realtime
Log Sources
Windows
