Rorschach Ransomware Execution with Unique Command Line
Detects Rorschach ransomware execution activity by looking for specific system utilities being executed with a distinct command-line string ('11111111'). The utilities include bcdedit.exe, net.exe, net1.exe, netsh.exe, wevtutil.exe, and vssadmin.exe, which are commonly abused by ransomware for defense evasion, system modification, and data destruction.
Sigma
