Rule to detect Pico Ransomware

Hunt Hypothesis

This detection rule identifies early-stage Pico ransomware activity by monitoring for specific file encryption patterns and process execution anomalies indicative of its initial infection phase. Proactive hunting in Azure Sentinel is essential to validate these low-severity alerts against baseline behavior, ensuring that potential lateral movement or data exfiltration associated with Pico is identified before significant business disruption occurs.

YARA Rule

rule pico_ransomware {
   
   meta:
   
      description = "Rule to detect Pico Ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://twitter.com/siri_urz/status/1035138577934557184"
      
   strings:

      $s1 = "C:\\Users\\rikfe\\Desktop\\Ransomware\\ThanatosSource\\Release\\Ransomware.pdb" fullword ascii
      $s2 = "\\Downloads\\README.txt" fullword ascii
      $s3 = "\\Music\\README.txt" fullword ascii
      $s4 = "\\Videos\\README.txt" fullword ascii
      $s5 = "\\Pictures\\README.txt" fullword ascii
      $s6 = "\\Desktop\\README.txt" fullword ascii
      $s7 = "\\Documents\\README.txt" fullword ascii
      $s8 = "/c taskkill /im " fullword ascii
      $s9 = "\\AppData\\Roaming\\" fullword ascii
      $s10 = "gMozilla/5.0 (Windows NT 6.1) Thanatos/1.1" fullword wide
      $s11 = "AppData\\Roaming" fullword ascii
      $s12 = "\\Downloads" fullword ascii
      $s13 = "operator co_await" fullword ascii
   
   condition:
      ( uint16(0) == 0x5a4d and filesize < 700KB ) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 13 string patterns in its detection logic.

References

• https://twitter.com/siri_urz/status/1035138577934557184
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Pico Ransomware detection rule in an enterprise environment, along with suggested filters or exclusions:

• Enterprise Backup Agent Scanning Operations

  • Scenario: The Pico ransomware signature often triggers on high-volume file encryption and metadata modification. Legitimate backup agents like Veeam Backup & Replication, Commvault, or Rubrik frequently scan, lock, and encrypt large datasets during their scheduled “Backup Window” (e.g., nightly at 02:00 UTC), mimicking the rapid file locking behavior of an active ransomware infection.
  • Filter/Exclusion: Create a whitelist exclusion for processes running under specific service accounts (e.g., svc-veeam-backup, commvault-agent) and restrict detection to non-business hours if the backup schedule is known, or exclude paths matching standard backup staging directories (e.g., C:\VeeamBackup\ or /mnt/backup_staging).

• Antivirus Real-Time Scanning and Quarantine

  • Scenario: Security suites such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint perform real-time scanning that involves opening, reading, modifying (e.g., adding digital signatures), and sometimes encrypting files upon detection of threats. This activity can generate the same “rapid file modification” alerts associated with Pico ransomware, particularly when a scheduled definition update triggers a full system scan.
  • Filter/Exclusion: Exclude events where the parent process is a known security vendor executable (e.g., C:\Program Files\CrowdStrike\cs.exe, MsMpEng.exe) and filter out alerts originating from specific “Quarantine” or “Scan” sub-processes that do not involve user-initiated file access.

• **Scheduled System Maintenance and Patch