Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
2
1
1
1
1
Platforms
3
Products / Services
1
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
This query identifies the launch pattern associated with wastedlocker ransomware.
Reference writeup: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us
Reference writeup: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us
This YARA rule detects the WastedLocker ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for two distinct sets of byte sequences, '$find_files_p*' and '$encrypt_files_p*', which are indicative of the ransomware's operational code. The presence of all these patterns, combined with the standard PE file magic number (0x5A4D), suggests the presence of the WastedLocker malware.
Yara rule that detects WastedLocker ransomware.