LockerGoga Ransomware Indicators in Windows Process Command Line
Flags Windows processes with a specific LockerGoga-style command-line argument pattern.
- Product
- windows
- Category
- process_creation
- Author
- Vasiliy Burov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-18
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies executions whose command line contains a specific argument pattern associated with LockerGoga ransomware activity. Attackers may rely on such command-line parameters to configure input paths, runtime behavior, or IPC-related functionality during encryption. The detection relies on Windows process creation telemetry that captures the full command line for spawned processes.
Reporting behind it
- medium.comhttps://medium.com/@malwaredancer/lockergoga-input-arguments-ipc-communication-and-others-bd4e5a7ba80a
- blog.f-secure.comhttps://blog.f-secure.com/analysis-of-lockergoga-ransomware/
- carbonblack.comhttps://www.carbonblack.com/blog/tau-threat-intelligence-notification-lockergoga-ransomware/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/LockerGoga/proc_creation_win_malware_lockergoga_ransomware.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: LockerGoga Ransomware Indicators in Windows Process Command Line
id: d9d8fb86-e9cc-473f-998d-f614b834a8f5
status: stable
description: This rule identifies executions whose command line contains a specific argument pattern associated with LockerGoga ransomware activity. Attackers may rely on such command-line parameters to configure input paths, runtime behavior, or IPC-related functionality during encryption. The detection relies on Windows process creation telemetry that captures the full command line for spawned processes.
references:
- https://medium.com/@malwaredancer/lockergoga-input-arguments-ipc-communication-and-others-bd4e5a7ba80a
- https://blog.f-secure.com/analysis-of-lockergoga-ransomware/
- https://www.carbonblack.com/blog/tau-threat-intelligence-notification-lockergoga-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/LockerGoga/proc_creation_win_malware_lockergoga_ransomware.yml
author: Vasiliy Burov, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2023-02-03
tags:
- attack.impact
- attack.t1486
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: -i SM-tgytutrc -s
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 74db3488-fd28-480a-95aa-b7af626de068
type: derived