This hypothesis posits that adversaries are deploying Shrug2 ransomware within the Azure environment, characterized by specific file encryption patterns and process execution behaviors unique to this strain. The SOC team should proactively hunt for these indicators in Azure Sentinel to validate early-stage infections before they escalate into high-severity incidents, ensuring rapid containment despite the rule’s current low severity classification.
rule shrug2_ransomware {
meta:
description = "Rule to detect Shrug2 ransomware"
author = "Marc Rivero | @seifreed"
reference = "https://blogs.quickheal.com/new-net-ransomware-shrug2/"
strings:
$s1 = "C:\\Users\\Gamer\\Desktop\\Shrug2\\ShrugTwo\\ShrugTwo\\obj\\Debug\\ShrugTwo.pdb" fullword ascii
$s2 = "http://tempacc11vl.000webhostapp.com/" fullword wide
$s4 = "Shortcut for @[email protected]" fullword wide
$s5 = "C:\\Users\\" fullword wide
$s6 = "http://clients3.google.com/generate_204" fullword wide
$s7 = "\\Desktop\\@[email protected]" fullword wide
condition:
( uint16(0) == 0x5a4d and filesize < 2000KB ) and all of them
}This YARA rule can be deployed in the following contexts:
This rule contains 6 string patterns in its detection logic.
Here are 5 specific false positive scenarios for the Shrug2 Ransomware detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Enterprise Backup Agent File Encryption
vbrservice.exe) performs a scheduled incremental backup of the “Finance-Shared” volume. During this process, Veeam encrypts metadata files and creates temporary lock files using AES-256, which mimics the file modification patterns Shrug2 uses during its initial encryption phase.C:\Program Files\Veeam\Backup and Replication\Agent\vbrservice.exe and restrict detection to files with extensions other than common backup logs (e.g., exclude .vbk, .vrb) or limit alerts to file sizes under 50MB if Shrug2 typically targets larger documents.Windows Defender Scheduled Scan
MsMpEng.exe) triggers a deep heuristic analysis on the “HR-Records” directory. As part of its remediation workflow, it quarantines suspicious files and rewrites their headers, generating a high volume of file write events that resemble ransomware encryption activity.MsMpEng.exe specifically when the parent process is TaskScheduler (indicating a scheduled job). Additionally, filter out alerts where the file extension remains unchanged before and after the event (e.g., .docx to .docx), as Shrug2 typically appends unique extensions.Office 365 ProPlus AutoSave & Co-Authoring