Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
MAL_SUSP_RANSOM_LockBit_RansomNote_Feb24.yarrule MAL_SUSP_RANSOM_LockBit_RansomNote_Feb24
{
meta:
description = "Detects the LockBit ransom note file 'LockBit-DECRYPT.txt' which is a sign of a LockBit ransomware infection"
author = "Florian Roth"
reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
date = "2024-02-23"
score = 75
id = "b2fcb2a7-49e8-520c-944f-6acd5ded579b"
strings:
$x1 = ">>>> Your personal DECRYPTION ID:"
condition:
1 of them
}