REvil Kaseya Incident Malware Patterns
Detects specific command-line patterns and process image paths associated with the REvil ransomware group's attack on Kaseya VSA. The rule looks for execution of 'cert.exe' and 'MsMpEng.exe' from unusual paths, as well as specific file deletion commands and references to 'Kaseya VSA Agent Hot-fix' and 'agent.exe'/'agent.crt' in 'kworking' or 'kworking1' directories, which were observed during the Kaseya supply chain incident.
Sigma
