Merge pull request #3919 from ruppde/master

Add more ransomware strings

rules/category/antivirus/av_password_dumper.yml

@@ -5,9 +5,10 @@ description: Detects a highly relevant Antivirus alert that reports a password d
 references:
     - https://www.nextron-systems.com/2018/09/08/antivirus-event-analysis-cheat-sheet-v1-4/
     - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619/detection
+    - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448
 author: Florian Roth
 date: 2018/09/09
-modified: 2022/05/12
+modified: 2023/01/13
 tags:
     - attack.credential_access
     - attack.t1003
@@ -32,6 +33,7 @@ detection:
             - 'LsassDump'
             - 'Outflank'
             - 'DumpLsass'
+            - 'SharpDump'
     condition: selection
 fields:
     - FileName

rules/category/antivirus/av_ransomware.yml

@@ -4,9 +4,14 @@ status: experimental
 description: Detects a highly relevant Antivirus alert that reports ransomware
 references:
     - https://www.nextron-systems.com/?s=antivirus
-author: Florian Roth
+    - https://www.virustotal.com/gui/file/43b0f7872900bd234975a0877744554f4f355dc57505517abd1ef611e1ce6916
+    - https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7
+    - https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045
+    - https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d
+    - https://www.virustotal.com/gui/file/69fe77dd558e281621418980040e2af89a2547d377d0f2875502005ce22bc95c
+author: Florian Roth, Arnim Rupp
 date: 2022/05/12
-modified: 2022/10/24
+modified: 2023/01/13
 tags:
     - attack.t1486
 logsource:
@@ -16,6 +21,19 @@ detection:
         Signature|contains:
             - 'Ransom'
             - 'Filecoder'
+            - 'Ryuk'
+            - 'Cryptor'
+            - 'Crypter'
+            - 'Destructor'
+            - 'TeslaCrypt'
+            - 'Locker'
+            - 'Tescrypt'
+            - 'CRYPTES'
+            - 'Krypt'
+            - 'GandCrab'
+            - 'Ryzerlo'
+            - 'BlackWorm'
+            - 'Phobos'
     condition: selection
 falsepositives:
     - Unlikely