Rule to detect PetrWrap ransomware samples

Hunt Hypothesis

This hunt targets adversary behavior where PetrWrap ransomware executes initial reconnaissance or file encryption activities within the Azure environment. Proactively hunting for these specific samples allows the SOC team to identify early-stage infections before they escalate into high-severity incidents that disrupt critical business operations.

YARA Rule

rule ransomware_PetrWrap 
{
meta:
	copyright= "Kaspersky Lab"
	description = "Rule to detect PetrWrap ransomware samples"
    reference = "https://securelist.com/schroedingers-petya/78870/"
	last_modified = "2017-06-27"
	author = "Kaspersky Lab"
	hash = "71B6A493388E7D0B40C83CE903BC6B04"
	version = "1.0"
strings:
	$a1 = "MIIBCgKCAQEAxP/VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV/uHB0ZrlQ/wcYJBwLhQ9EqJ3iDqmN19Oo7NtyEUmbYmopcqYLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy/mf0JFWixz29QiTf5oLu15wVLONCuEibGaNNpgqCXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu" fullword wide
	$a2 = ".3ds.7z.accdb.ai.asp.aspx.avhd.back.bak.c.cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.kdbx.mail.mdb.msg.nrg.ora.ost.ova.ovf.pdf.php.pmf.ppt.pptx.pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox.vbs.vcb.vdi.vfd.vmc.vmdk.vmsd.vmx.vsdx.vsv.work.xls" fullword wide
	$a3 = "DESTROY ALL OF YOUR DATA PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED" fullword ascii
	$a4 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" fullword ascii
	$a5 = "wowsmith123456posteo.net." fullword wide
condition:
	uint16(0) == 0x5A4D and filesize < 1000000 and any of them 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• https://securelist.com/schroedingers-petya/78870/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the PetrWrap Ransomware detection rule, including suggested filters and exclusions:

• Enterprise Backup Agent File Encryption

  • Scenario: The backup agent (e.g., Veeam Backup & Replication, Commvault, or Rubrik) performs a scheduled “snapshot” or data compression task that involves reading and temporarily encrypting large volumes of user data files. This activity mimics the rapid file modification and encryption behavior typical of PetrWrap ransomware.
  • Filter/Exclusion: Create an exclusion rule to whitelist processes running under the specific backup service accounts (e.g., VeeamTransportService, RubrikAgent) and restrict detection to non-backup time windows if possible, or explicitly exclude file paths within known backup staging directories (e.g., C:\Program Files\Commvault).

• Antivirus Real-Time Scanning with Heuristics

  • Scenario: The endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) initiates a deep heuristic scan on newly downloaded executables. During this process, the AV engine may lock, read, and write temporary encrypted copies of files in the C:\Windows\SoftwareDistribution or user Downloads folders, triggering the “file encryption” logic of the PetrWrap rule.
  • Filter/Exclusion: Exclude events where the parent process is a known security vendor executable (e.g., csagent.exe, SentinelOneAgent.exe) and add a filter to ignore file operations occurring within standard quarantine or temporary download directories (C:\Windows\Temp, %TEMP%).

• Scheduled Document Management Indexing

  • Scenario: A document management system (e.g., SharePoint, DocuWare, or M-Files)