Windows Process Execution Indicative of Ryuk-Style Ransomware Behavior

Flags suspicious Windows process command lines combining autorun persistence, public staging, file backup wiping, and service stoppage behavior.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-12-16
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547.001Registry Run Keys / Startup Folder
Priv Esc
- T1547.001Registry Run Keys / Startup Folder
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation activity that matches a combination of behaviors commonly seen in Ryuk-style ransomware operations. It looks for command-line activity related to persistence via Run key paths and public directories, file deletion patterns for backups, and network stop execution using specific net.exe images with related service names. The detection relies on Windows process creation telemetry that includes command lines and the executed image path, and it triggers when any one of the defined match groups is satisfied.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange

Malicious Run Key Persistence Referencing DLL in User Documents

PlugX Persistence via Run Key Named AAM Updatevlm

Suspicious Autorun Registry Persistence via sausageLoop Run Key

Malicious BabyLockerKZ Run Key Persistence

Suspicious Run Key Persistence Pointing To User-Writable Path

Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)

Persistence Run Key Pointing to svchost.exe in AppData Roaming

URL Shortcut File Created in Startup Folder for Persistence

Suspicious Run Key Persistence via UpdateCheck Value in Operation TrueChaos

Windows Process Execution Indicative of Ryuk-Style Ransomware Behavior

Pivot detection · T1547.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-command-lines-indicative-of-ryuk-style-ransomware-staging-c37510b8

title: Windows Process Execution Indicative of Ryuk-Style Ransomware Behavior
id: 8158adee-e129-43fa-b56f-8efcbcea72a6
related:
  - id: 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
    type: similar
  - id: 0acaad27-9f02-4136-a243-c357202edd74
    type: obsolete
  - id: c37510b8-2107-4b78-aa32-72f251e7a844
    type: derived
status: stable
description: This rule flags Windows process creation activity that matches a combination of behaviors commonly seen in Ryuk-style ransomware operations. It looks for command-line activity related to persistence via Run key paths and public directories, file deletion patterns for backups, and network stop execution using specific net.exe images with related service names. The detection relies on Windows process creation telemetry that includes command lines and the executed image path, and it triggers when any one of the defined match groups is satisfied.
references:
  - https://app.any.run/tasks/d860402c-3ff4-4c1f-b367-0237da714ed1/
  - https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ryuk/proc_creation_win_malware_ryuk.yml
author: Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-12-16
modified: 2023-02-03
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg:
    CommandLine|contains|all:
      - Microsoft\Windows\CurrentVersion\Run
      - C:\users\Public\
  selection_del:
    CommandLine|contains|all:
      - del /s /f /q c:\
      - \*.bac
      - \*.bak
      - \*.bkf
  selection_net:
    Image|endswith:
      - \net.exe
      - \net1.exe
    CommandLine|contains|all:
      - " stop "
      - " /y"
    CommandLine|contains:
      - samss
      - audioendpointbuilder
      - unistoresvc_
      - AcrSch2Svc
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL