AN0602
Analytic 0602
Windows
High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=2
[FileExtension]
Non-standard or randomly generated file extensions may indicate encrypted content.
[TargetFolder]
Focus on user document folders, network shares, or system paths like %System32%.
[TimeWindow]
Correlate rapid writes and renames within seconds across high file count.
[CommandLine]
Flag common ransomware tools or functions (vssadmin delete shadows /all /quiet).
AN0603
Analytic 0603
Linux
Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.
auditd:SYSCALL
openat, write, rename, unlink
auditd:SYSCALL
execve
[FilenamePattern]
Look for creation of ransom note files (e.g., READ_ME.txt, HELP_DECRYPT.html).
[SyscallBurstRate]
High write/open/unlink activity in short intervals indicates encryption attempts.
[DirectoryTargeted]
Correlate activity in /home, /etc, /opt, or mounted volumes.
AN0604
Analytic 0604
macOS
Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using `srm`, `gpg`, or compiled payloads. Often correlated with ransom note creation in multiple directories.
macos:unifiedlog
file encrypted|new file with .encrypted extension|disk write burst
macos:unifiedlog
exec srm|exec openssl|exec gpg
[ExtensionPattern]
Encrypted files may use .locked, .enc, or ransom-specific extensions.
[VolumeTargeted]
Detect activity targeting mounted external or backup volumes.
AN0605
Analytic 0605
ESXi
Ransomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through `dcui`, SSH, or vSphere.
esxi:vmkernel
rename .vmdk to .*.locked|datastore write spike
esxi:shell
openssl|tar|dd
[FileType]
Detect renames or write patterns involving .vmdk, .vmx, .nvram.
[UserContext]
Identify shell sessions opened by root or unexpected users outside maintenance window.
AN0606
Analytic 0606
IaaS
Encryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.
AWS:CloudTrail
PutObject (with SSE-C), UploadPart (SSE-C)
[SSEHeader]
SSE-C headers indicate attacker-controlled encryption keys.
[AffectedBucket]
Prioritize logs, backups, or shared document storage buckets.
[UserAgent]
Detect scripted automation vs console-based API behavior.