ryuk_sample__sysmon_behavior

rule ryuk_sample__sysmon_behavior {
 meta:
    author = "Lee Archinal"
    description = "This content detects characteristics of a recent sample of Ryuk malware  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/NmICNE0Bnx4q"
    version = "0.01"
    created = "2019/03/16"
    product = "windows"
    service = "sysmon"
    mitre = "Impact, T1490"

  events:
(($selection1.metadata.product_event_type = "1" and (((((($selection1.target.process.file.full_path = "hveffNueElan.exe" or $selection1.target.process.file.full_path = "mBXRPRuhYlan.exe") or ($selection1.target.process.file.full_path = "icacls.exe" and re.regex($selection1.target.process.command_line, `icacls C:.* /grant Everyone:F /T /C /Qþþ`))) or ($selection1.target.process.file.full_path = "cmd.exe" and ($selection1.target.process.command_line = "cmd.exe /c bcdedit /set {default} recoveryenabled No & bcdedit /set {default}" or $selection1.target.process.command_line = "cmd.exe /c WMIC.exe shadowcopy delete" or $selection1.target.process.command_line = "cmd.exe /c vssadmin.exe Delete Shadows /all /quiet" or re.regex($selection1.target.process.command_line, `C:\\Windows\\System32\\cmd\.exe /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v EV /t REG_SZ /d .* /f /reg:64`)))) or ($selection1.target.process.file.full_path = "bcdedit.exe" and ($selection1.target.process.command_line = "bcdedit /set {default}" or $selection1.target.process.command_line = "bcdedit /set {default} recoveryenabled No"))) or ($selection1.target.process.file.full_path = "net.exe" and $selection1.target.process.command_line = "C:\\Windows\\System32\\net.exe stop samss /y")) or ($selection1.target.process.file.full_path = "reg.exe" and re.regex($selection1.target.process.command_line, `REG ADD HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v EV /t REG_SZ /d .* /f /reg:64`)))) or ($selection1.metadata.product_event_type = "13" and re.regex($selection1.target.registry.registry_key, `REGISTRY\\USER\\S-1-5-21-638615289-2068236702-2426684043-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\EV .*`) and re.regex($selection1.metadata.description, `.*`)))

  condition:
    $selection1
}