Reynolds Ransomware OOBE and Cluster Environment Detection for Sandbox Evasion
Detects behaviors associated with ransomware attempting to evade sandbox or virtual machine environments. This rule specifically looks for checks against the 'OOBEInProgress' and 'SystemSetupInProgress' registry values under '\Registry\Machine\System\Setup', and the presence of '_CLUSTER_NETWORK_NAME_' in process command lines. These checks are often performed by malware, such as Reynolds ransomware, to determine if it is running in an analysis environment before proceeding with malicious activities like encryption.
Microsoft Sentinel (KQL)
