Ragnar Locker ransomware detections
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
This rule tracks a Ragnar Locker ransomware attack by detecting the installation of a suspicious MSI followed by undetectable virtual machine (VM) installation, shadow copy deletion, and the execution of a process that encrypts files on the host machine.
Severity
Critical
Rule Requirement
Criteria
Action1: actionname = "null" AND (PROCESSNAME endswith "msiexec.exe") Action2: actionname = "File created" AND ((OBJECTNAME contains "\Program Files (x86)" OR OBJECTNAME contains "\Program Files") AND OBJECTNAME endswith "VirtualAppliances\va.exe") AND HOSTNAME = Action1.HOSTNAME Action3: actionname = "null" AND PROCESSNAME = Action2.OBJECTNAME AND HOSTNAME = Action1.HOSTNAME Action4: actionname = "null" AND (PROCESSNAME endswith "vssadmin.exe") AND HOSTNAME = Action1.HOSTNAME Action5: actionname = "null" AND (PROCESSNAME endswith "VboxHeadless.exe") AND HOSTNAME = Action1.HOSTNAME sequence:Action1 followedby Action2 within 30s followedby Action3 within 2m followedby Action4 within 2m followedby Action5 within 10m select Action2.HOSTNAME,Action2.MESSAGE,Action2.USERNAME,Action2.DOMAIN,Action2.OBJECTNAME,Action2.PROCESSNAME,Action2.ACCESSLIST,,,
Detection
Execution Mode
realtime
Log Sources
Windows
