Linux_Ransomware_RoyalPest_502a3db6

rule Linux_Ransomware_RoyalPest_502a3db6 {
    meta:
        author = "Elastic Security"
        id = "502a3db6-4711-42c7-8178-c3150f184fc6"
        fingerprint = "4bde7998f41ef3d0f2769078cf56e03d36eacf503f859a23fc442ced95d839cb"
        creation_date = "2023-07-27"
        last_modified = "2024-02-13"
        threat_name = "Linux.Ransomware.RoyalPest"
        reference_sample = "09a79e5e20fa4f5aae610c8ce3fe954029a91972b56c6576035ff7e0ec4c1d14"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $a1 = "hit by Royal ransomware."
        $a2 = "Please contact us via :"
        $a3 = ".onion/%s"
        $a4 = "esxcli vm process list > list"
    condition:
        3 of them
}