LockerGoga Ransomware Command Line Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects LockerGoga ransomware activity by identifying a specific command-line argument pattern used by the malware. The rule looks for the string '-i SM-tgytutrc -s' within process command lines, which is a known indicator of LockerGoga execution.