Skip to content

Instantly share code, notes, and snippets.

@Shivammalaviya

Shivammalaviya/Detects Medusa Locker Ransomware

Last active September 21, 2022 12:42
Show Gist options
  • Save Shivammalaviya/3d0c387da0e142934435e55cfcdb7db3 to your computer and use it in GitHub Desktop.
Save Shivammalaviya/3d0c387da0e142934435e55cfcdb7db3 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Detects Medusa Locker Ransomware
SecurityEvent
| where EventID == 4688 | where ((ParentProcessName endswith @'\scpvss.exe')
and (NewProcessName endswith @'\vssadmin.exe' or NewProcessName endswith @'\WMIC.exe' or NewProcessName endswith @'\wbadmin.exe'
or NewProcessName endswith @'\bcdedit.exe'))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment