GhostLock SMB Exclusive Handle Accumulation
Detects exclusive SMB file handle requests (ShareAccess = 0), which are utilized by the GhostLock denial-of-service technique. GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors. Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
Sigma
