huntrule

Windows: Rorschach execution indicator via critical command-line pattern

Windows process creation events with certain system utilities and a "11111111" command-line marker are flagged as ransomware execution activity.

FreeReviewedSigma · Critical · v5
Product
windows
Category
process_creation
Author
X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-04-04
Updated
2026-07-31
AnalysisDetection
title: "Windows: Rorschach execution indicator via critical command-line pattern"
id: 064274b9-95e1-42e9-a5cb-f2b66a2d333d
status: test
description: This rule flags Windows process executions where the executable name matches specific system utilities and the command line contains the value "11111111". Such behavior is consistent with ransomware-style attempts to manipulate or disable host services and recovery mechanisms. Detection relies on Windows process creation telemetry including the image path and full command line arguments.
references:
  - https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Rorschach/proc_creation_win_malware_rorschach_ransomware_activity.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-04-04
modified: 2023-04-22
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \bcdedit.exe
      - \net.exe
      - \net1.exe
      - \netsh.exe
      - \wevtutil.exe
      - \vssadmin.exe
    CommandLine|contains: "11111111"
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 0e9e6c63-1350-48c4-9fa1-7ccb235edc68
    type: derived