Rorschach ransomware execution behavior on Windows via command-line indicators

title: Rorschach ransomware execution behavior on Windows via command-line indicators
id: 064274b9-95e1-42e9-a5cb-f2b66a2d333d
status: test
description: This rule flags Windows process executions where the process image name ends with specific system utility binaries and the command line contains the marker string "11111111". Attackers often use built-in Windows tools during ransomware activity to manipulate system state, which makes these executions a high-signal indicator when combined with the distinctive command-line value. The detection relies on process creation telemetry including Image and CommandLine fields.
references:
  - https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Rorschach/proc_creation_win_malware_rorschach_ransomware_activity.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-04-04
modified: 2023-04-22
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \bcdedit.exe
      - \net.exe
      - \net1.exe
      - \netsh.exe
      - \wevtutil.exe
      - \vssadmin.exe
    CommandLine|contains: "11111111"
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 0e9e6c63-1350-48c4-9fa1-7ccb235edc68
    type: derived