Linux_Ransomware_Lockbit_d248e80e

rule Linux_Ransomware_Lockbit_d248e80e {
    meta:
        author = "Elastic Security"
        id = "d248e80e-3e2f-4957-adc3-0c912b0cd386"
        fingerprint = "417ecf5a0b6030ed5b973186efa1e72dfa56886ba6cfc5fbf615e0814c24992f"
        creation_date = "2023-07-27"
        last_modified = "2024-02-13"
        threat_name = "Linux.Ransomware.Lockbit"
        reference_sample = "4800a67ceff340d2ab4f79406a01f58e5a97d589b29b35394b2a82a299b19745"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $a1 = "restore-my-files.txt" fullword
        $b1 = "xkeyboard-config" fullword
        $b2 = "bootsect.bak" fullword
        $b3 = "lockbit" fullword
        $b4 = "Error: %s" fullword
        $b5 = "crypto_generichash_blake2b_final" fullword
    condition:
        $a1 and 2 of ($b*)
}