<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p>Hi Alexis<br></p><p>Suricata in fact is very appropriate tool for ransomware and very effective one too.<br></p><p>The rule category you need to look in is trojan-activity and there are thousands of rules in there. Please find below details of one such rule to do with the recent wannacry stuff. I have cut and pasted from a rule manager in order to show you all of the options more clearly.</p><p>Hope it helps.<br></p><p>regards<br></p><p>Amar.<br></p><table style="line-height: 1em; margin: 0.5em auto;" class="mce-item-table" cellspacing="0" cellpadding="0" border="0"><tbody><tr><td style="text-align: left; border-bottom: 1px solid #555555; padding: 0.4em 1em; border-top: 1px solid #555555;" width="10" valign="top"> </td><td style="text-align: left; border-bottom: 1px solid #555555; padding: 0.4em 1em; border-top: 1px solid #555555;" valign="top"><div class="tabArea"><a class="activetab" href="https://demo1.countersnipe.com:8443/signature/signature?page=summary&signatureID=22541">Summary</a> <a class="tab" href="https://demo1.countersnipe.com:8443/signature/signature?page=view&signatureID=22541">View</a> <a class="tab" href="https://demo1.countersnipe.com:8443/signature/signature?page=action&signatureID=22541">Action</a><br></div><br><p>Suricata Rule: ACTION smb any any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible ETERNALBLUE Exploit M3 MS17-010"; sid:2024430; rev:2; classtype:trojan-activity; flow:to_server,established; content:"|ff|SMB|32 00 00 00 00 18 07 c0|"; offset:4; depth:12; content:"|00 00 00 00 00 00 00 00 00 00 00 08 ff fe 00 08|"; distance:2; within:16; fast_pattern; content:"|0f 0c 00 00 10 01 00 00 00 00 00 00 00 f2 00 00 00 00 00 0c 00 42 00 00 10 4e 00 01 00 0e 00 0d 10 00|"; distance:2; within:34; isdataat:1000,relative; threshold: type both, track by_src, count 10, seconds 1; )</p>Name: ET CURRENT_EVENTS Possible ETERNALBLUE Exploit M3 MS17-010 <br> Sid: 2024430 <br> Revision: 2 <br> Classification: trojan-activity (High)<br> Group: <a href="https://demo1.countersnipe.com:8443/signature/signature?action=List&signatureGroupID=52">trojan-activity</a><br> Protocol: smb <br> Source: any <br> Source Port: any <br> Direction: -> <br> Destination: $HOME_NET <br> Destination Port: any</td></tr></tbody></table><blockquote type="cite">On June 29, 2017 at 8:42 PM Alexis Fredes Hadad <amfh2408@gmail.com> wrote:<br><br><div dir="ltr"><div><div><div>Hello everyone!<br></div>I want to know if there is any rule for ransomware detection in Suricata. I know that Suricata is not the more appropiate tool for that kind of malware but I was investigating how to do a rule with pcre. Anyone knows if exist a rule for that? Or a rule set which contain that? At present I am using the free version of Emerging Threats and it has a file of rules for malware but I couldn't find nothing related to ransomware.<br><br></div>Thanks,<br></div>Alexis</div>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br></blockquote></body></html>