SubPattern Name: UEBA

This is the named definition of the event query, this is important if multiple subpatterns are defined to distinguish them.

SubPattern Query

This is the query logic that matches incoming events

eventType CONTAIN "FINS-Windows-" AND fileName IN ("!! return files !!.txt", "!!! how to decrypt files !!!.txt", "!!! read this - important !!!.txt", "!!!!!save your files!!!!.txt", "!!!!restore_files!!!.txt", "!!!-warning-!!!.html", "!!!-warning-!!!.txt", "!!!getbackdata!!!.txt", "!!!read_it!!!.txt", "!!!read_to_unlock!!!.txt", "!!!readmetodecrypt.txt", "!!!save your files!.bmp", "!## decrypt files ##!.txt", "!#_decrypt_#!.inf", "!#_how_to_decrypt_files_#!", "!#_how_to_decrypt_files_$!.txt", "!=how_to_decrypt_files=!.txt", "!_!email__ prusa@goat.si __!..payman", "!____________deskrypt@tutamail.com________.rar", "!_how_recovery_files_!.txt", "!_recovery_help_!.txt", "!back_files!.html", "!gblock_info.rtf", "!ooopsyourfileslocked!.rtf", "!pedant_info!.rtf", "!please read me!.txt", "!read.htm", "!readme_gman!.rtf", "!readme_grhan!.rtf", "!satana!.txt", "!sblock_info!.rtf", "!wannadecryptor!.exe.lnk", "!where_are_my_files!.html", "# decrypt my files #.html", "# decrypt my files #.txt", "# decrypt my files #.vbs", "# how to decrypt files.txt", "# readme.hta", "###-read-for-hellpp.html", "#_#whatwrongwithmyfiles#_#.rtf", "#_decrypt_assistance_#.txt", "#_restoring_files_#.txt", "#help-decrypt-fcrypt1.1#.txt", "#how_decrypt_files#.html", "#how_to_unrip#.txt", "#newrar_readme#.rtf", "#readme_gman#.rtf", "#recovery_files#.txt", "$%%! note about files -=!-.html", "---readme---.txt", ".[decryptor@cock.li].dcrtr", "000-if-you-want-dec-files.html", "000-no-problem-we-dec-files.html", "000-please-read-we-help.html", "0000-sorry-for-files.html", "00000000.eky", "00000000.pky", "00000000.res", "001-read-for-decrypt-files.html", "005-do-you-want-files.html", "009-read-for-decccc-filesss.html", "0_help_decrypt_files.htm", "131181494299235.bat", "170fb7438316.exe", "176641494574290.bat", "217201494590800.bat", "4-14-2016-infection.txt", "52036f92.tmp", "@decrypt_your_files.txt", "@please_read_me@.txt", "@wanadecryptor@.exe", "@wanadecryptor@.exe.lnk", "[amanda_sofost@india.com].wallet", "\"!ymayka-email@yahoo.com.cryptotes\"", "_adatok_visszaallitasahoz_utasitasok.txt", "_crypt", "_decrypt_info_szesnl.html", "_help_instruction.txt", "_help_instructions.bmp", "_help_instructions.txt", "_help_recover_files_.html", "_how_recover.txt", "_how_to_decrypt.bmp", "_howdo_text.html", "_interesting_informacion_for_decrypt.txt", "_iwashere.txt", "_locky_recover_instructions.bmp", "_locky_recover_instructions.txt", "_read_me_for_decrypt.txt", "_readme_.hta", "_recover_instructions.ini", "_ryp", "_secret_code.txt", "_what_is.html", "_xiaoba_info_.hta", "aari.jpg", "about_files.txt", "aescrypt.exe", "allcry_upx.exe", "anatova.exe", "anatova.txt", "assistance_in_recovery.txt", "atlas_files.txt", "attention!!!.txt", "attention.url", "bahij2@india.com", "bitcryptorfilelist.txt", "blooper.exe", "btc_decrypt_files.txt", "buyunlockcode", "buyunlockcode.txt", "callofcthulhu.exe", "clopreadme.txt", "coin.locker.txt", "como descriptografar seus arquivos.txt", "como_abrir_arquivos.txt", "como_restaurar_archivos.html", "como_restaurar_archivos.txt", "confirmation.key", "crjoker.html", "cryptinfo.txt", "cryptoransomware.exe", "crytp0l0cker.dll", "crytp0l0cker.exe", "crytp0l0cker.upack.dll", "cscc.dat", "cversions.2.db", "cyber splitter vbs.exe", "dale_files.txt", "de_crypt_readme.bmp", "de_crypt_readme.html", "de_crypt_readme.txt", "decoding help.hta", "decrypt explanations.html", "decrypt_info.txt", "decrypt_information.html", "decrypt_instruction.html", "decrypt_instruction.txt", "decrypt_instruction.url", "decrypt_instructions.html", "decrypt_instructions.txt", "decrypt_readme.txt", "decrypt_readme.txt.readme", "decrypt_readme1.txt", "decrypt_your_files.html", "decrypt_your_files.txt", "decryptallfiles.txt", "decrypted_files.dat", "decryptfile.txt", "decryption instructions.txt", "decryption.txt", "decryption_howto.notepad", "decypt_your_files.html", "default32643264.bmp", "default432643264.jpg", "desifrovani_pokyny.html", "desktoposiris.htm", "dispci.exe", "dllhost.dat", "ebay-msg.html", "ebay_was_here", "enc_files.txt", "encryptor_raas_readme_liesmich.txt", "enigma.hta", "enigma_encr.txt", "entschlusseln_hinweise.html", "exit.hhr.obleep", "fe04.tmp", "file decrypt help.html", "file0locked.js", "file_encryption_notice.txt", "files encrypted.html", "files encrypted.txt", "files.txt", "files_back.txt", "filesaregone.txt", "filesinfo.txt", "firstransomware.exe", "galaperidol.exe", "getyoufiles.txt", "gjenoppretting_av_filer.html", "gjenoppretting_av_filer.txt", "hacked_read_me_to_decrypt_files.html", "hello there! fellow @kee user!.txt", "hellothere.txt", "help decrypt.html", "help-file-decrypt.enc", "help-me-enced-files.html", "help_decrypt.html", "help_decrypt.lnk", "help_decrypt.png", "help_decrypt.txt", "help_decrypt.url", "help_decrypt_your_files.html", "help_me_please.txt", "help_recover_files.txt", "help_restore_files.txt", "help_to_decrypt.txt", "help_to_decrypt_your_files.txt", "help_to_save_files.bmp", "help_to_save_files.txt", "help_your_files.html", "help_your_files.png", "help_your_files.txt", "help_yourfiles.html", "helpdecrypt.txt", "helpdecyprt_your_files.html", "how decript files.hta", "how decrypt files.hta", "how decrypt my files.lnk", "how to decode files.hta", "how to decrypt aes files.lnk", "how to decrypt files.html", "how to decrypt files.txt", "how to decrypt lechiffre files.html", "how to decrypt your data.txt", "how to decrypt your files.jpg", "how to decrypt your files.txt", "how to decrypt.txt", "how to decrypt[1t0to].txt", "how to get back you files.txt", "how to get data back.txt", "how to get data.txt", "how to recover encrypted files-infovip@airmail.cc.txt", "how to recover encrypted files.txt", "how to restore files.hta", "how to restore files.txt", "how-to-decrypt-files.html", "how-to-restore-files.txt", "how_can_i_decrypt_my_files.txt", "how_decrypt.gif", "how_decrypt.html", "how_decrypt.txt", "how_decrypt.url", "how_decrypt_files#.html", "how_decrypt_files.hta", "how_decrypt_my_files", "how_open_files.hta", "how_return_files.txt", "how_to_back_files.html", "how_to_decrypt.html", "how_to_decrypt_files.html", "how_to_decrypt_files.txt", "how_to_decrypt_my_files.txt", "how_to_decrypt_your_files.jpg", "how_to_fix_!.txt", "how_to_recover_files.txt", "how_to_recver_files.txt", "how_to_restore_files.hta", "how_to_restore_files.html", "how_to_restore_files.txt", "how_to_restore_your_data.html", "howdecrypt.gif", "howdecrypt.txt", "howto_recover_file.txt", "howto_restore_files.html", "howto_restore_files.txt", "howtodecryptaesfiles.txt", "howtodecryptimportant!.txt", "howtorestore_files.txt", "hur_dekryptera_filer.html", "hur_dekryptera_filer.txt", "hvordan_du_gendanner_filer.html", "hvordan_du_gendanner_filer.txt", "hwid lock.exe", "iamreadytopay.txt", "if you want to get all your files back, please read this.txt", "if_want_files_back_pls_read.html", "if_you_want_to_get_all_your_files_back_please_read_this.txt", "ihaveyoursecret.key", "important read me.txt", "important!.txt", "important.readme", "important_read_me.txt", "info.hta", "infpub.dat", "install_tor.url", "instrucciones.txt", "instrucciones_descifrado.html", "instrucciones_descifrado.txt", "instruction for file recovery.txt", "instruction restore file.txt", "instruction_for_helping_file_recovery.txt", "instructionaga.txt", "instructions_de_decryptage.html", "instructions_xxxx.png", "istruzioni_decrittazione.html", "kryptolocker_readme.txt", "last_chance.txt", "lblbitcoininfomain.txt", "lblfinallytext.txt", "lblmain.txt", "leer_inmediatamente.txt", "leia_me.txt", "locked.bmp", "lukitus.html", "matrix-readme.rtf", "maxcrypt.bmp", "mensagem.txt", "merry_i_love_you_bruce.hta", "message.txt", "mood-ravishing-hd-wallpaper-142943312215.jpg", "note;!!!-odzyskaj-pliki-!!!.txt", "oksowathappendtoyourfiles.txt", "oku.txt", "okubeni.txt", "ontsleutelings_instructies.html", "ownertrust.txt", "padcrypt.exe", "padcryptuninstaller.exe", "paxynok.html", "paycrypt.bmp", "payment-instructions.txt", "payment_advice.mht", "payment_instructions.jpg", "perfect.sys", "petwrap.exe", "please read me!.txt", "please-readit-if_you-want.html", "popcorn_time.exe", "pronk.txt", "qeriuwjhrf", "qwer.html", "qwer2.html", "qwerty-pub.key", "rans0m_n0te_read_me.txt", "ransom.rtf", "ransomed.html", "read if you want your files back.html", "read me (how decrypt) !!!!.txt", "read me about decryption.txt", "read me for decrypt.txt", "read me for help thanks.txt", "read-read-read.html", "read.txt", "read@my.txt", "read__it.txt", "read_decrypt_files.txt", "read_it.txt", "read_it_for_get_your_file.txt", "read_me.html", "read_me_!.txt", "read_me_asap.txt", "read_me_help.png", "read_me_help.txt", "read_me_to_decrypt_you_informa.jjj", "read_this_file.txt", "read_this_file_1.txt", "read_this_to_decrypt.html", "read_to_decrypt.html", "readdecryptfileshere.txt", "readme how to decrypt your files.html", "readme!!!.txt", "readme-matrix.rtf", "readme.hta", "readme_decryptor.txt", "readme_for_decrypt.txt", "readme_how_to_unlock.html", "readme_how_to_unlock.txt", "readme_important.txt", "readme_liesmich_encryptor_raas.txt", "readme_restore_files.txt", "readme_to_recure_your_files.txt", "readthisnow!!!.txt", "receipt.exe", "recover-files.html", "recover.bmp", "recover.txt", "recovery_file.txt", "recovery_files.txt", "recovery_key.txt", "recupere seus arquivos aqui.txt", "redchip2.exe", "restore files.txt", "restore-.-files.txt", "restore-12345-files.txt", "restore_corupted_files.html", "restore_files.html", "restore_files.txt", "restore_icpicp_files.txt", "restore_maysomware_files.html", "restore_your_files.txt", "restorefiles.txt", "rtext.txt", "runsome.exe", "screenlocker_x86.dll", "secret.key", "secretidhere.key", "security-issue-info.txt", "shtodelatvam.txt", "sifre_coz_talimat.html", "sifre_cozme_talimati.html", "sintalocker.exe", "sintarun.py", "spreader_x86.dll", "ssexecutor_x86.exe", "strongcrypt.bmp", "struttergear.exe", "survey locker.exe", "svchosd.exe", "t.wry", "taskdl.exe", "taskhsvc.exe", "tasksche.exe", "taskse.exe", "tempimage.jpg", "thxforyurtyme.txt", "tor.exe", "totallylegit.exe", "tox.html", "trumphead.exe", "try-read-me-to-dec.html", "tutoriel.bmp", "unblockfiles.vbs", "unlock_files_instructions.html", "unlock_files_instructions.txt", "uselessdisk.exe", "vape launcher.exe", "vault.hta", "vault.key", "vault.txt", "vip72.exe", "wannacry.exe", "wannacry.txt", "wannacrypt 4.0.exe", "wcry.exe", "wcry.zip", "we-must-dec-files.html", "what happen to my files.txt", "whathappenedwithfiles.rtf", "whathappenedwithmyfiles.rtf", "where-your-files.html", "wie_zum_wiederherstellen_von_dateien.txt", "winclwp.jpg", "windowsapplication1.exe", "xort.txt", "you_must_read_me.rtf", "yougothacked.txt", "your files are locked !!!!.txt", "your files are locked !!!.txt", "your files are locked !!.txt", "your files are locked !.txt", "your files are now encrypted.txt", "your files encrypted by our friends !!! txt", "your files encrypted by our friends !!!.txt", "your_files.html", "your_files.url", "your_files_are_dead.hta", "your_files_are_encrypted.html", "your_files_are_encrypted.txt", "your_files_are_locked.txt", "your_key.rsa", "yourid.txt", "zcrypt.exe", "zenis-instructions.html", "zino_note.txt", "zxz.html", "zzzzzzzzzzzzzzzzzyyy")  AND user NOT REGEXP ".*\$$|dwn-.*|dwm-.*|umfd-.*|.*SYSTEM.*|.*ANONYMOUS.*"

Group by Attributes

This defines how matching events are aggregated, only events with the same matching attribute values are grouped into one unique incident ID

hostName,domain,user,procName,activityName

Aggregate Constraint

This is most typically a numerical constraint that defines when the rule should trigger an incident

COUNT(*) >= 1