huntrule

Antivirus ransomware signature match (Babuk, Lockbit, Ryuk, WannaCry)

Flags antivirus ransomware detections when the alert signature contains known ransomware family name strings.

FreeReviewedSigma · Critical · v5
Category
antivirus
Author
Florian Roth (Nextron Systems), Arnim Rupp (SigmaHQ), DRL 1.1
Published
2022-05-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Antivirus alerts whose signature name contains common ransomware family or indicator strings such as Babuk, Lockbit, Ryuk, and WannaCry. Even when the AV blocked the malware, these detections matter because they indicate a likely ransomware payload attempt occurred and should be investigated for initial access and execution context. Telemetry relies on Antivirus alert metadata, specifically the Signature field content matching the listed ransomware-related substrings.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange
Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)
Suspicious CyberLock Ransomware Encrypted File Creation
Rhysida Ransomware Encrypted File Extension Created
Phobos 8Base Ransomware Encrypted File Extension Created
Rhysida Ransomware Note CriticalBreachDetected.pdf Created
Possible Akira Ransomware Note or Encrypted Extension Creation
Malicious Storm-2603 Ransom Note File Creation
Possible Ransomware Note or Encrypted File Extension Creation
BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)
Antivirus ransomware signature match (Babuk, Lockbit, Ryuk, WannaCry)
Pivot detection · T1486 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.