Linux_Ransomware_Quantum_8513fb8b

rule Linux_Ransomware_Quantum_8513fb8b {
    meta:
        author = "Elastic Security"
        id = "8513fb8b-43f7-46b1-8318-5549a7609d3b"
        fingerprint = "1c1af76ab5df8243b8e25555f1762749ca60da56fecea9d4131c612358244525"
        creation_date = "2023-07-28"
        last_modified = "2024-02-13"
        threat_name = "Linux.Ransomware.Quantum"
        reference_sample = "3bcb9ad92fdca53195f390fc4d8d721b504b38deeda25c1189a909a7011406c9"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $a1 = "All your files are encrypted on all devices across the network"
        $a2 = "process with pid %d is blocking %s, going to kill it"
    condition:
        all of them
}