Mailto ransomware detections
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
This rule detects MailTo ransomware malware execution and then the shadow copy deletion and multiple file modifications IoCs associated with MailTo ransomware attacks.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "null" AND (PROCESSNAME endswith "explorer.exe") Action2: actionname = "File created" AND ((OBJECTNAME contains "\AppData\Roaming" OR OBJECTNAME contains "\Program Files" OR OBJECTNAME contains "\Documents and Settings" OR OBJECTNAME contains "\Program Files(x86)") AND OBJECTNAME endswith "exe") AND HOSTNAME = Action1.HOSTNAME AND PROCESSNAME = Action1.PROCESSNAME Action3: actionname = "null" AND HOSTNAME = Action1.HOSTNAME AND PROCESSNAME = Action1.PROCESSNAME Action4: actionname = "null" AND (PROCESSNAME endswith "vssadmin.exe") AND HOSTNAME = Action1.HOSTNAME Action5: actionname = "null" AND HOSTNAME = Action1.HOSTNAME | timewindow 15m | groupby PROCESSNAME having COUNT > 10 sequence:Action1 followedby Action2 within 1m followedby Action3 within 1m followedby Action4 within 10m followedby Action5 within 1m select Action2.HOSTNAME,Action2.MESSAGE,Action2.USERNAME,Action2.DOMAIN,Action2.OBJECTNAME,Action2.PROCESSNAME,Action2.ACCESSLIST,,,
Detection
Execution Mode
realtime
Log Sources
Windows
