Sagan critical stable other

[WINDOWS-MALWARE] Encrypted file by Cryptowall ransomware extension detected (.cryptowall)

[WINDOWS-MALWARE] Encrypted file by Cryptowall ransomware extension detected (.cryptowall)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-MALWARE] Encrypted file by Cryptowall ransomware extension detected (.cryptowall)"; program:*Security*; event_id:4663,567,5145; content:".cryptowall "; nocase; after: track by_src, count 25, seconds 3600; threshold: type suppress, track by_src, count 25, seconds 3600; classtype:ransomware; sid:5006765; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...