MAL_SUSP_RANSOM_LockBit_RansomNote_Feb24

rule MAL_SUSP_RANSOM_LockBit_RansomNote_Feb24 {
   meta:
      description = "Detects the LockBit ransom note file 'LockBit-DECRYPT.txt' which is a sign of a LockBit ransomware infection"
      author = "Florian Roth"
      reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
      date = "2024-02-23"
      score = 75
      id = "b2fcb2a7-49e8-520c-944f-6acd5ded579b"
   strings:
      $x1 = ">>>> Your personal DECRYPTION ID:"
   condition:
      1 of them
}