CTB_Locker

Hunt Hypothesis

This detection rule identifies adversary behavior consistent with the CTB-Locker ransomware family, specifically focusing on its initial reconnaissance and file encryption activities within the environment. The SOC team should proactively hunt for these indicators in Azure Sentinel to validate early-stage infection signals before they escalate into high-severity incidents that disrupt critical business operations.

YARA Rule

rule BackdoorFCKG: CTB_Locker_Ransomware
{
meta:
author = "ISG"
date = "2015-01-20"
reference = "https://blogs.mcafee.com/mcafee-labs/rise-backdoor-fckq-ctb-locker"
description = "CTB_Locker"

strings:
$string0 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
$stringl = "RNDBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" 
$string2 = "keme132.DLL" 
$string3 = "klospad.pdb" 
condition:
3 of them 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• https://blogs.mcafee.com/mcafee-labs/rise-backdoor-fckq-ctb-locker
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the CTB_Locker detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Policy Deployment via SCCM/Intune

  • Scenario: During scheduled maintenance windows (e.g., Tuesday at 2:00 AM), the System Center Configuration Manager (SCCM) or Microsoft Intune agent pushes a new “Lock Down” policy to all workstations. This triggers CTB_Locker as it modifies registry keys and file permissions associated with the locker service, mimicking an unauthorized lock attempt.
  • Filter/Exclusion: Create a rule exclusion for processes originating from ccmexec.exe (SCCM) or Microsoft.IntuneManagementExtension.exe running under the SYSTEM account during defined maintenance windows (02:00–04:00 local time).

• Automated Backup Job Execution by Veeam

  • Scenario: The nightly backup job executed by Veeam Backup & Replication initiates a “Pre-Backup Lock” on critical database volumes to ensure data consistency. This action invokes the CTB_Locker service to freeze file handles, generating alerts that resemble a security lockdown event rather than a routine I/O operation.
  • Filter/Exclusion: Exclude events where the parent process is VeeamAgent.exe or vbragent64.exe and the target volume matches known backup mount points (e.g., D:\DB_Data, E:\SQL_Logs).

• Group Policy Object (GPO) Refresh for Compliance

  • Scenario: Every 90 minutes, domain-joined machines refresh Group Policy Objects. A specific GPO named “Security_Hardening_Lockdown” applies restrictions to the CTB_Locker service configuration via gpupdate.exe. This periodic configuration change