Raccine Uninstall Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects command-line activities indicative of the uninstallation of Raccine, a ransomware protection tool. It specifically looks for combinations of commands used to terminate Raccine processes, delete its registry entries, and remove its scheduled tasks. The detection logic covers `taskkill` commands targeting `RaccineSettings.exe`, `reg.exe delete` commands referencing "Raccine Tray", and `schtasks /DELETE` commands for "Raccine Rules Updater".