I hope you're all doing well.
I'm reaching out to the community for some guidance. As a test, I recently used Veeam intelligence to scan our infrastructure.
Based on the scan, Veeam intelligence created the following rule:
[
rule CommonRansomware
{
meta:
description = "Detects common ransomware families"
author = "Veeam Support Assistant"
date = "2023-10-01"
strings:
$locky = "Locky"
$wannacry = "WannaCry"
$petya = "Petya"
$notpetya = "NotPetya"
$cerber = "Cerber"
$cryptolocker = "CryptoLocker"
$cryptowall = "CryptoWall"
$badrabbit = "BadRabbit"
$ryuk = "Ryuk"
$maze = "Maze"
$revil = "REvil"
$darkside = "DarkSide"
condition:
any of them
}
the results scared me since it’s a bunch on files detected by this rule.
thanks in advance for reading
