netwalker_ransomware_detection

rule netwalker_ransomware_detection {
 meta:
    author = "Emir Erdogan"
    description = "Netwalker is a ransomware formerly called Mailto that has become active recently as it targets the enterprise and government agencies. Two widely reported attacks related to Netwalker are the ones on the Toll Group and the Champaign Urbana Public Health District (CHUPD) in Illinois.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/enTUnGxlNjxr"
    version = "0.01"
    created = "2020/03/23"
    product = "windows"
    mitre = "t1486"

  events:
(re.regex($selection.target.process.file.full_path, `.*vssadmin\.exe`) and re.regex($selection.principal.process.file.full_path, `.*qeSw\.exe`) and $selection.target.process.command_line = "vssadmin.exe delete shadows /all /quiet")

  condition:
    $selection
}