cypherpunk-exclusive-commands

Description

This query was originally published in the threat analytics report, Cypherpunk ransomware leaves wake of tampered AVs. Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files. The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.

Query · kql

// Searches for possible Cypherpunk ransomware activity
DeviceProcessEvents
| where InitiatingProcessParentFileName startswith "psexe"
| where ProcessCommandLine has "Dvr /go"
Raw source cypherpunk-exclusive-commands · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2affa440-24b5-48b2-a377-d5968a499658
name: cypherpunk-exclusive-commands
description: |
  This query was originally published in the threat analytics report, Cypherpunk ransomware leaves wake of tampered AVs.
  Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files.
  The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Ransomware
query: |
  // Searches for possible Cypherpunk ransomware activity
  DeviceProcessEvents
  | where InitiatingProcessParentFileName startswith "psexe"
  | where ProcessCommandLine has "Dvr /go"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.