DarkSide Ransomware Command Line and Process Pattern
Detects patterns associated with DarkSide Ransomware and its helper processes. Specifically, it looks for command-line arguments used by DarkSide, such as '=[char][byte]('0x'+' or ' -work worker0 -path ', or the execution of an image from the 'AppData\Local\Temp\' directory when the parent process is 'DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'.
Sigma
