Multi_Ransomware_BlackCat_e066d802

rule Multi_Ransomware_BlackCat_e066d802 {
    meta:
        author = "Elastic Security"
        id = "e066d802-b803-4e35-9b53-ae1823662483"
        fingerprint = "05037af3395b682d1831443757376064c873815ac4b6d1c09116715570f51f5d"
        creation_date = "2023-07-27"
        last_modified = "2023-09-20"
        threat_name = "Multi.Ransomware.BlackCat"
        reference_sample = "00360830bf5886288f23784b8df82804bf6f22258e410740db481df8a7701525"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "multi"
    strings:
        $a1 = "esxcli vm process kill --type=force --world-id=Killing"
        $a2 = "vim-cmd vmsvc/snapshot.removeall $i"
        $a3 = "File already has encrypted extension"
    condition:
        2 of them
}