Hayabusa critical test sigma

DarkSide Ransomware Pattern

Detects DarkSide Ransomware and helpers

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection1": {
    "CommandLine
| contains": [
      "=[char][byte]('0x'+",
      " -work worker0 -path "
    ]
  },
  "selection2": {
    "ParentCommandLine
| contains": "DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",
    "NewProcessName
| contains": "\\AppData\\Local\\Temp\\"
  },
  "condition": "process_creation and (1 of selection*)"
}

False Positives

  • ⚠ Unknown
  • ⚠ UAC bypass method used by other malware

Field Validations

Loading…

Comments (0)

Loading comments...