LoFP LoFP / if there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential fps.

Techniques

Sample rules

Ryuk Test Files Detected

Description

The search looks for files that contain the key word Ryuk under any folder in the C drive, which is consistent with Ryuk propagation.

Detection logic


| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path" 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `ryuk_test_files_detected_filter`