Antivirus - Ransomware Signature

Status: test
Severity: critical
Log source: category antivirus
Author: Florian Roth (Nextron Systems), Arnim Rupp
Source: github.com/SigmaHQ/sigma

Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1486` Data Encrypted for Impact

Rule body

title: Antivirus - Ransomware Signature
id: 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
status: test
description: |
    Detects a highly relevant Antivirus alert that reports ransomware.
    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
references:
    - https://www.nextron-systems.com/?s=antivirus
    - https://www.virustotal.com/gui/file/43b0f7872900bd234975a0877744554f4f355dc57505517abd1ef611e1ce6916
    - https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7
    - https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045
    - https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d
    - https://www.virustotal.com/gui/file/69fe77dd558e281621418980040e2af89a2547d377d0f2875502005ce22bc95c
    - https://www.virustotal.com/gui/file/6f0f20da34396166df352bf301b3c59ef42b0bc67f52af3d541b0161c47ede05
author: Florian Roth (Nextron Systems), Arnim Rupp
date: 2022-05-12
modified: 2026-06-15
tags:
    - attack.t1486
    - attack.impact
logsource:
    category: antivirus
detection:
    selection:
        Signature|contains:
            - 'Babuk'
            - 'Babyk'
            - 'BlackWorm'
            - 'Chaos'
            - 'Cobra'
            - 'ContiCrypt'
            - 'Crypter'
            - 'Cryptes'
            - 'Cryptor'
            - 'CylanCrypt'
            - 'DelShad'
            - 'Destructor'
            - 'Filecoder'
            - 'GandCrab'
            - 'GrandCrab'
            - 'Haperlock'
            - 'Hiddentear'
            - 'HydraCrypt'
            - 'Krypt'
            - 'Lockbit'
            - 'Locker'
            - 'Mallox'
            - 'Medusa'
            - 'Phobos'
            - 'Ransom'
            - 'Rook'
            - 'Ryuk'
            - 'Ryzerlo'
            - 'Stopcrypt'
            - 'Tescrypt'
            - 'TeslaCrypt'
            - 'WannaCry'
            - 'Xorist'
    condition: selection
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Signature|contains:
        - 'Babuk'
        - 'Babyk'
        - 'BlackWorm'
        - 'Chaos'
        - 'Cobra'
        - 'ContiCrypt'
        - 'Crypter'
        - 'Cryptes'
        - 'Cryptor'
        - 'CylanCrypt'
        - 'DelShad'
        - 'Destructor'
        - 'Filecoder'
        - 'GandCrab'
        - 'GrandCrab'
        - 'Haperlock'
        - 'Hiddentear'
        - 'HydraCrypt'
        - 'Krypt'
        - 'Lockbit'
        - 'Locker'
        - 'Mallox'
        - 'Medusa'
        - 'Phobos'
        - 'Ransom'
        - 'Rook'
        - 'Ryuk'
        - 'Ryzerlo'
        - 'Stopcrypt'
        - 'Tescrypt'
        - 'TeslaCrypt'
        - 'WannaCry'
        - 'Xorist'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Signature`	match	`Babuk` `Babyk` `BlackWorm` `Chaos` `Cobra` `ContiCrypt` `Crypter` `Cryptes` `Cryptor` `CylanCrypt` `DelShad` `Destructor` `Filecoder` `GandCrab` `GrandCrab` `Haperlock` `Hiddentear` `HydraCrypt` `Krypt` `Lockbit` `Locker` `Mallox` `Medusa` `Phobos` `Ransom` `Rook` `Ryuk` `Ryzerlo` `Stopcrypt` `Tescrypt` `TeslaCrypt` `WannaCry` `Xorist`	`field:"Signature" kind:match`