Potential Ryuk Ransomware Activity

{
  "selection_reg": {
    "CommandLine
| contains
| all": [
      "Microsoft\\Windows\\CurrentVersion\\Run",
      "C:\\users\\Public\\"
    ]
  },
  "selection_del": {
    "CommandLine
| contains
| all": [
      "del /s /f /q c:\\",
      "\\*.bac",
      "\\*.bak",
      "\\*.bkf"
    ]
  },
  "selection_net": {
    "Image
| endswith": [
      "\\net.exe",
      "\\net1.exe"
    ],
    "CommandLine
| contains
| all": [
      " stop ",
      " /y"
    ],
    "CommandLine
| contains": [
      "samss",
      "audioendpointbuilder",
      "unistoresvc_",
      "AcrSch2Svc"
    ]
  },
  "condition": "1 of selection_*"
}

False Positives

• ⚠ Unlikely