Coronavirus ransomware detections
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
This rule detects execution of "file2.exe", a malware file associated with CoronaVirus ransomware attacks and also the shadow copy deletion and multiple file modification IoCs associated with CoronaVirus ransomware attacks.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "File created" AND (OBJECTNAME contains "\AppData\Local\Temp" AND OBJECTNAME endswith "exe") Action2: actionname = "null" AND PROCESSNAME = Action1.OBJECTNAME AND HOSTNAME = Action1.HOSTNAME Action3: actionname = "null" AND (PROCESSNAME endswith "vssadmin.exe" OR PROCESSNAME endswith "wbadmin.exe") AND HOSTNAME = Action1.HOSTNAME Action4: actionname = "null" AND HOSTNAME = Action1.HOSTNAME AND PROCESSNAME = Action1.OBJECTNAME | timewindow 10m | groupby PROCESSNAME having COUNT > 10 sequence:Action1 followedby Action2 within 30s followedby Action3 within 30s followedby Action4 within 5m select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.ACCESSLIST,,,
Detection
Execution Mode
realtime
Log Sources
Windows
