Windows Process Execution Indicative of Ryuk-Style Ransomware Behavior
Flags suspicious Windows process command lines combining autorun persistence, public staging, file backup wiping, and service stoppage behavior.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-12-16
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation activity that matches a combination of behaviors commonly seen in Ryuk-style ransomware operations. It looks for command-line activity related to persistence via Run key paths and public directories, file deletion patterns for backups, and network stop execution using specific net.exe images with related service names. The detection relies on Windows process creation telemetry that includes command lines and the executed image path, and it triggers when any one of the defined match groups is satisfied.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution Indicative of Ryuk-Style Ransomware Behavior
id: 8158adee-e129-43fa-b56f-8efcbcea72a6
related:
- id: 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
type: similar
- id: 0acaad27-9f02-4136-a243-c357202edd74
type: obsolete
- id: c37510b8-2107-4b78-aa32-72f251e7a844
type: derived
status: stable
description: This rule flags Windows process creation activity that matches a combination of behaviors commonly seen in Ryuk-style ransomware operations. It looks for command-line activity related to persistence via Run key paths and public directories, file deletion patterns for backups, and network stop execution using specific net.exe images with related service names. The detection relies on Windows process creation telemetry that includes command lines and the executed image path, and it triggers when any one of the defined match groups is satisfied.
references:
- https://app.any.run/tasks/d860402c-3ff4-4c1f-b367-0237da714ed1/
- https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ryuk/proc_creation_win_malware_ryuk.yml
author: Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-12-16
modified: 2023-02-03
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_reg:
CommandLine|contains|all:
- Microsoft\Windows\CurrentVersion\Run
- C:\users\Public\
selection_del:
CommandLine|contains|all:
- del /s /f /q c:\
- \*.bac
- \*.bak
- \*.bkf
selection_net:
Image|endswith:
- \net.exe
- \net1.exe
CommandLine|contains|all:
- " stop "
- " /y"
CommandLine|contains:
- samss
- audioendpointbuilder
- unistoresvc_
- AcrSch2Svc
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1