Rule to detect an unpacked sample of Shiva ransopmw

Hunt Hypothesis

This hunt targets adversaries deploying the Shiva ransomware family by identifying unpacked samples that may indicate early-stage reconnaissance or lateral movement before encryption begins. Proactively hunting for these artifacts in Azure Sentinel is critical to validate detection coverage and ensure rapid containment of potential outbreaks, even when initial severity signals are low.

YARA Rule

rule unpacked_shiva_ransomware {

   meta:

      description = "Rule to detect an unpacked sample of Shiva ransopmw"
      author = "Marc Rivero | @seifreed"
      reference = "https://twitter.com/malwrhunterteam/status/1037424962569732096"
    
   strings:

      $s1 = "c:\\Users\\sys\\Desktop\\v 0.5\\Shiva\\Shiva\\obj\\Debug\\shiva.pdb" fullword ascii
      $s2 = "This email will be as confirmation you are ready to pay for decryption key." fullword wide
      $s3 = "Your important files are now encrypted due to a security problem with your PC!" fullword wide
      $s4 = "write.php?info=" fullword wide
      $s5 = " * Do not try to decrypt your data using third party software, it may cause permanent data loss." fullword wide
      $s6 = " * Do not rename encrypted files." fullword wide
      $s7 = ".compositiontemplate" fullword wide
      $s8 = "You have to pay for decryption in Bitcoins. The price depends on how fast you write to us." fullword wide
      $s9 = "\\READ_IT.txt" fullword wide
      $s10 = ".lastlogin" fullword wide
      $s11 = ".logonxp" fullword wide
      $s12 = " * Decryption of your files with the help of third parties may cause increased price" fullword wide
      $s13 = "After payment we will send you the decryption tool that will decrypt all your files." fullword wide
   
   condition:

      ( uint16(0) == 0x5a4d and filesize < 800KB ) and all of them 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 13 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “Shiva ransomware” detection rule in a legitimate enterprise environment, along with suggested filters or exclusions:

Antivirus Definition Updates via Scheduled Task
- Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) performs a scheduled nightly update. During this process, the AV engine extracts and scans compressed definition files that contain signatures resembling the “Shiva” ransomware payload structure before they are fully deployed to the active scanning engine.
- Filter/Exclusion: Create an exclusion for processes spawned by the specific AV service (e.g., C:\Program Files\CrowdStrike\fs.exe or MsMpEng.exe) when the file path is located within the vendor’s dedicated update directory (e.g., \ProgramData\Microsoft\Windows Defender\Updates\).
IT Admin Manual Artifact Analysis
- Scenario: A security analyst or IT administrator manually downloads a known “Shiva” ransomware sample from a threat intelligence feed (such as VirusTotal or an internal sandbox) to test the organization’s email gateway. The admin extracts this sample into a temporary analysis folder (C:\Temp\Threat_Analysis) and opens it with a hex editor or static analyzer, triggering the unpacking event without any malicious intent.
- Filter/Exclusion: Exclude file paths under specific administrative work directories (e.g., C:\Users\Admins\*, D:\Sandbox_Quarantine\*) and filter by user accounts belonging to the “Security_Ops” or “IT_Administrators” security groups.
Software Deployment via Configuration Management Tools
- Scenario: The IT operations team uses a configuration management tool like SCCM (System Center Configuration Manager) or Ansible to deploy a new application package. This package includes a compressed archive