title: Ryuk Ransomware
author: Vasiliy Burov
date: 2019/08/06
description: Detects Ryuk Ransomware command lines
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image:
    - '*\net.exe'
    - '*\net1.exe'
  SELECTION_3:
    CommandLine: '*stop*'
  SELECTION_4:
    CommandLine:
    - '*samss*'
    - '*audioendpointbuilder*'
    - '*unistoresvc_?????*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- Unlikely
id: 0acaad27-9f02-4136-a243-c357202edd74
level: critical
logsource:
  category: process_creation
  product: windows
references:
- https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/
status: experimental
tags:
- attack.execution
- attack.t1204
ruletype: SIGMA