Merge pull request #3465 from SigmaHQ/rule-devel

Havana Ransomware UA
2022-09-06 09:15:31 +02:00
parent efe4d62a54 b4cae0d551
commit 97d65f4bfd
1 changed files with 2 additions and 1 deletions
@@ -10,7 +10,7 @@ references:
  - https://perishablepress.com/blacklist/ua-2013.txt
  - https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents
 date: 2017/07/08
-modified: 2021/11/27
+modified: 2022/09/05
 logsource:
  category: proxy
 detection:
@@ -75,6 +75,7 @@ detection:
      - 'record'  # https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/
      - 'mozzzzzzzzzzz'  # https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/
      - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0'  # Quasar RAT UA https://twitter.com/malmoeb/status/1559994820692672519?s=20&t=g3tkNL09dZZWbFN10qDVjg
+      - 'Havana/0.1'  # https://www.cybereason.com/blog/threat-alert-havanacrypt-ransomware-masquerading-as-google-update
  condition: selection
 fields:
  - ClientIP