Potential Ryuk Ransomware Activity

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_reg": {
    "CommandLine
| contains
| all": [
      "Microsoft\\Windows\\CurrentVersion\\Run",
      "C:\\users\\Public\\"
    ]
  },
  "selection_del": {
    "CommandLine
| contains
| all": [
      "del /s /f /q c:\\",
      "\\*.bac",
      "\\*.bak",
      "\\*.bkf"
    ]
  },
  "selection_net": {
    "CommandLine
| contains
| all": [
      " stop ",
      " /y"
    ],
    "CommandLine
| contains": [
      "samss",
      "audioendpointbuilder",
      "unistoresvc_",
      "AcrSch2Svc"
    ],
    "NewProcessName
| endswith": [
      "\\net.exe",
      "\\net1.exe"
    ]
  },
  "condition": "process_creation and (1 of selection_*)"
}

False Positives

• ⚠ Unlikely