Bad_Tuesday_Cryptor.co

event Psexesvc_started:
    key:
        event_src.host
    filter {
        correlation_name == null and
        event_src.host != null and
        msgid == "4688" and
        lower(object.name) == "psexesvc.exe" and
        event_src.title == "windows"
    }
    
event Schtasks_started:
    key:
        event_src.host
    filter {
        correlation_name == null and
        event_src.host != null and
        msgid == "4688" and
        lower(object.name) == "schtasks.exe" and
        event_src.title == "windows"
    }
    
rule Bad_Tuesday_Cryptor: (Psexesvc_started -> Schtasks_started ) within 5m
    
    on Psexesvc_started {
        $subject.name = subject.name
        $subject.domain = subject.domain
        
        $event_src.host = event_src.host
        $event_src.vendor = event_src.vendor
        $event_src.title = event_src.title
    }
    
emit {
    $correlation_name = "Bad_Tuesday_Cryptor"
    $correlation_type = "incident"
    
    $subject = "account"
    $action = "initiate"
    $object = "attack"
    $status = "success"
    
    $category.generic = "Malware"
    $category.high = "Miscellaneous"
    $category.low = "Detection"
    
    $id = "PT_SIEM_Bad_Tuesday_Cryptor"
    $importance = "high"
}