Regla para detectar RANSOM.LOCKY

Hunt Hypothesis

This hunt hypothesis targets adversary behavior consistent with the LOCKY ransomware family by identifying specific file encryption patterns and process execution anomalies indicative of an active infection. Proactively hunting for these indicators in Azure Sentinel is critical to validate the low-severity rule’s efficacy and ensure early containment before widespread data encryption occurs across the organization.

YARA Rule

rule Locky_Ransomware_2: ransom {
meta:
    description = "Regla para detectar RANSOM.LOCKY"
    author = "CCN-CERT"
    version = "1.0"
strings:
    $a1 = { 2E 00 6C 00 6F 00 63 00 6B 00 79 00 00 }
    $a2 = { 00 5F 00 4C 00 6F 00 63 00 6B 00 79 00 }
    $a3 = { 5F 00 72 00 65 00 63 00 6F 00 76 00 65 }
    $a4 = { 00 72 00 5F 00 69 00 6E 00 73 00 74 00 }
    $a5 = { 72 00 75 00 63 00 74 00 69 00 6F 00 6E }
    $a6 = { 00 73 00 2E 00 74 00 78 00 74 00 00 }
    $a7 = { 53 6F 66 74 77 61 72 65 5C 4C 6F 63 6B 79 00 }
condition:
    all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the RANSOM.LOCKY detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legacy Backup Agent Cryptographic Operations

  • Scenario: The Veeam Backup & Replication agent (running as vbr.exe or VeeamAgent.exe) performs nightly incremental backups. During this process, the agent encrypts large volumes of data on disk using AES-256, generating rapid file creation and modification events that mimic Locky’s encryption behavior.
  • Filter/Exclusion: Exclude processes running under the service account DOMAIN\VeeamService or specifically filter for executable paths containing \Program Files\Veeam\Backup. Additionally, exclude events where the parent process is vbr.exe.

• Enterprise Antivirus Real-Time Scanning

  • Scenario: The CrowdStrike Falcon sensor performs a scheduled “On-Demand” deep scan of the user’s home directory. During this scan, the antivirus engine temporarily locks and rewrites file headers or creates temporary quarantine copies (.tmp files) for thousands of documents simultaneously, triggering high-volume file modification alerts.
  • Filter/Exclusion: Create an exclusion rule for processes with the binary name Cortex.exe or falcon.container.sys located in C:\Program Files\CrowdStrike\. Exclude events where the file extension being modified is .tmp and the process has a valid digital signature from “CrowdStrike”.

• Document Management System (DMS) Indexing

  • Scenario: The Microsoft SharePoint Services crawler or DocuWare indexing service runs during business hours to update metadata for newly uploaded contracts. This involves opening, reading, and rewriting file properties (metadata) across a shared network drive (\\fileserver\contracts