Modifying the registry to add a ransom message notification

Description

Identify registry modifications that is indicative of a ransom note tied to DEV-0270.

Query · kql

DeviceProcessEvents 
| where InitiatingProcessCommandLine has_all('"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f', 'RecoveryKeyMessage', 'Your drives are Encrypted!', '@')
Raw source Modifying the registry to add a ransom message notification · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: acd4112f-5271-4680-ab2a-f07952d71888
name: Modifying the registry to add a ransom message notification
description: |
  Identify registry modifications that is indicative of a ransom note tied to DEV-0270.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Impact
query: |   
  DeviceProcessEvents 
  | where InitiatingProcessCommandLine has_all('"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f', 'RecoveryKeyMessage', 'Your drives are Encrypted!', '@')

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.