Detections

Analysis of Hide Your RDP: Password Spray Leads to RansomHub Deployment

RDP Password Spray Followed by RansomHub Crypter

sigma · generated; parse required before publication

title: RDP Password Spray Followed by RansomHub Crypter
description: Detects high-volume RDP logon failures followed by rapid successful admin
  login and RansomHub execution.
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: '4625'
    LogonType: '10'
  condition: selection
level: medium
tags: []
references: []

MAL_RANSOM_RansomHub_Payload

yara · compile required before publication

rule MAL_RANSOM_RansomHub_Payload {
  strings:
    $s1 = "RansomHub_v2_Locker" ascii wide nocase
    $s2 = "Your network has been compromised" ascii wide nocase
    $s3 = "chacha20_encryption_key" ascii wide nocase
  condition:
    any of them
}