huntrule

Windows Process Command Lines Indicative of Ryuk-Style Ransomware Staging

Flags suspicious Windows process command lines combining autorun persistence, public staging, file backup wiping, and service stoppage behavior.

FreeUnreviewedSigmahighv1
title: Windows Process Command Lines Indicative of Ryuk-Style Ransomware Staging
id: 8158adee-e129-43fa-b56f-8efcbcea72a6
related:
  - id: 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
    type: similar
  - id: 0acaad27-9f02-4136-a243-c357202edd74
    type: obsolete
  - id: c37510b8-2107-4b78-aa32-72f251e7a844
    type: derived
status: stable
description: This rule flags Windows process creation events where command lines reference Windows autorun registry paths, public directory usage, and common backup/file deletion targets. It also matches execution of net.exe variants with commands consistent with stopping services, along with specific service-related strings that may be used to disrupt recovery. The detection relies on process command-line and image name telemetry to identify these combined behaviors that commonly occur during ransomware staging and pre-encryption disruption.
references:
  - https://app.any.run/tasks/d860402c-3ff4-4c1f-b367-0237da714ed1/
  - https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ryuk/proc_creation_win_malware_ryuk.yml
author: Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-12-16
modified: 2023-02-03
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg:
    CommandLine|contains|all:
      - Microsoft\Windows\CurrentVersion\Run
      - C:\users\Public\
  selection_del:
    CommandLine|contains|all:
      - del /s /f /q c:\
      - \*.bac
      - \*.bak
      - \*.bkf
  selection_net:
    Image|endswith:
      - \net.exe
      - \net1.exe
    CommandLine|contains|all:
      - " stop "
      - " /y"
    CommandLine|contains:
      - samss
      - audioendpointbuilder
      - unistoresvc_
      - AcrSch2Svc
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation events where command lines reference Windows autorun registry paths, public directory usage, and common backup/file deletion targets. It also matches execution of net.exe variants with commands consistent with stopping services, along with specific service-related strings that may be used to disrupt recovery. The detection relies on process command-line and image name telemetry to identify these combined behaviors that commonly occur during ransomware staging and pre-encryption disruption.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.