covid19_ransomware_detection

rule covid19_ransomware_detection {
 meta:
    author = "Osman Demir"
    description = "Covid19 Ransomware Detection  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/Eu4ylhtTfcjb"
    version = "0.01"
    created = "2021-03-09"
    product = "windows"
    service = "sysmon"
    mitre = "t1471, impact"

  events:
(($selection.metadata.product_event_type = "1" and re.regex($selection.principal.process.file.full_path, `.*\\winword\.exe`) and re.regex($selection.target.process.file.full_path, `.*\\cmd\.exe`) and re.regex($selection.principal.process.file.full_path, `.*\\cmd\.exe`) and re.regex($selection.target.process.file.full_path, `.*\\reg\.exe`) and $selection.target.process.command_line = "reg delete \"HKCU\\Software\\Microsoft\\Office\\14.0\\Word\\Resiliency\" /F" and $selection.metadata.product_event_type = "11" and re.regex($selection.target.process.file.full_path, `.*\\winword\.exe`) and re.regex($selection.target.file.full_path, `.*\\AppData\\Local\\Temp\\20200323-sitrep-63-covid-19\.doc`) and $selection.metadata.product_event_type = "3" and $selection.target.process.file.full_path = "C:\\Users\\admin\\AppData\\Local\\svchost.exe") or (($selection.target.file.md5 = "2779863A173FF975148CB3156EE593CB5719A0AB238EA7C9E0B0CA3B5A4A9326" or $selection.target.file.md5 = "62D38F19E67013CE7B2A84CB17362C77E2F13134EE3F8743CBADDE818483E617" or $selection.target.file.md5 = "FA84EE006B205F105DF40DD2ABCF238653F8CEF0" or $selection.target.file.md5 = "994A67D5D6341173AD95BC6F5D795FD0") or $selection.target.ip = "31.170.167.123"))

  condition:
    $selection
}