A ransom note rule that stops flagging the FAQ
A loose ransom-note rule fires on finance documents that mention bitcoin. Read a tighter rule that uses a regex, a count, and filesize, measure the difference, and explain each condition.
Briefing
During a ransomware drill the file share sweep flagged dozens of documents, burying the two real notes. The loose rule matches any file mentioning bitcoin, .onion, or decrypt.
In a condition, #name counts the matches of one string, "N of them" needs N different strings, and filesize limits matches to small files. Each one removes a different kind of false positive.
detect-lab · YARA triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.