paymen45_ransomware

rule paymen45_ransomware {
 meta:
    author = "Osman Demir"
    description = "Detects Paymen45 Ransomware  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/xl7e1g3hoPkA"
    version = "0.01"
    created = "2021-03-09"
    product = "windows"
    service = "sysmon"
    mitre = "T1486, Impact"

  events:
(($selection.metadata.product_event_type = "1" and $selection.principal.process.file.full_path = "Paymen45.exe" and $selection.target.process.file.full_path = "C:\\Windows\\system32\\vssadmin.exe" and $selection.target.process.command_line = "vssadmin delete shadows /all /quiet") or ($selection.metadata.product_event_type = "11" and $selection.target.process.file.full_path = "Paymen45.exe" and ($selection.target.file.full_path = "C:\\Users\\admin\\AppData\\Local\\VirtualStore\\Program Files\\Adobe\\Acrobat Reader DC\\Esl
eadme.txt" or $selection.target.file.full_path = "C:\\Users\\admin\\Desktop
eadme.txt")) or ($selection.target.file.md5 = "4b12f4fdf07d06fb59b5619d01a293c51d32efd183d45a87459b47d5169cfe51" or $selection.target.file.md5 = "f9dc9848892b3c1ca620a7a69cce4ff5bbf03cdfd0ad12f348973ea76d4d125e"))

  condition:
    $selection
}