LockerGoga Ransomware Indicators in Windows Process Command Line

Flags Windows processes with a specific LockerGoga-style command-line argument pattern.

FreeReviewedSigma · Critical · v5

Product: windows
Category: process_creation
Author: Vasiliy Burov, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-18
Updated: 2026-07-31

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule identifies executions whose command line contains a specific argument pattern associated with LockerGoga ransomware activity. Attackers may rely on such command-line parameters to configure input paths, runtime behavior, or IPC-related functionality during encryption. The detection relies on Windows process creation telemetry that captures the full command line for spawned processes.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious JADEPUFFER Lockd Encryptor Execution

Suspicious Mass Locked Extension File Creation by Ransomware

Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)

Malicious Ransomware Encryption Extension x2anylock

Malicious Fivehands Go Encryptor Execution via Command Line Flags

Malicious SafePay Ransomware Encryptor Command-Line Execution

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

Malicious GigaWiper Ransomware File Extension .candy

Malicious Forced BitLocker Encryption for Extortion (via process_creation)

LockerGoga Ransomware Indicators in Windows Process Command Line

Pivot detection · T1486 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

lockergoga-ransomware-command-line-pattern-windows-process-creation-74db3488

title: LockerGoga Ransomware Indicators in Windows Process Command Line
id: d9d8fb86-e9cc-473f-998d-f614b834a8f5
status: stable
description: This rule identifies executions whose command line contains a specific argument pattern associated with LockerGoga ransomware activity. Attackers may rely on such command-line parameters to configure input paths, runtime behavior, or IPC-related functionality during encryption. The detection relies on Windows process creation telemetry that captures the full command line for spawned processes.
references:
  - https://medium.com/@malwaredancer/lockergoga-input-arguments-ipc-communication-and-others-bd4e5a7ba80a
  - https://blog.f-secure.com/analysis-of-lockergoga-ransomware/
  - https://www.carbonblack.com/blog/tau-threat-intelligence-notification-lockergoga-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/LockerGoga/proc_creation_win_malware_lockergoga_ransomware.yml
author: Vasiliy Burov, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2023-02-03
tags:
  - attack.impact
  - attack.t1486
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: -i SM-tgytutrc -s
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 74db3488-fd28-480a-95aa-b7af626de068
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL