Detection Rules - new_enc.exe - Human-Operated Rust Ransomware

Generated: 2026-01-26 Threat Level: CRITICAL Rule Category: Ransomware Detection

YARA Rules

Rule 1: new_enc.exe File Hash Detection

rule new_enc_exe_file_hash {
    meta:
        description = "Detects new_enc.exe Arsenal-237 ransomware by file hash"
        author = "The Hunters Ledger"
        date = "2026-01-26"
        severity = "CRITICAL"
        malware_type = "Ransomware"
        family = "Arsenal-237"

    strings:
        $md5 = "a16ba61114fa5a40afce54459bbff21e" wide ascii
        $sha1 = "2c01cefba27c4d3fcb3b450cb8e625e89bc54363" wide ascii
        $sha256 = "90d223b70448d68f7f48397df6a9e57de3a6b389d5d8dc0896be633ca95720f2" wide ascii

    condition:
        any of them
}

Rule 2: Hardcoded ChaCha20 Encryption Key Detection

rule arsenal_237_chacha20_key {
    meta:
        description = "Detects Arsenal-237 hardcoded ChaCha20 encryption key"
        author = "The Hunters Ledger"
        date = "2026-01-26"
        severity = "CRITICAL"
        ioc_type = "Cryptographic Material"
        confidence = "CONFIRMED"

    strings:
        $key_hex = "67e6096a85ae67bb72f36e3c3af54fa57f520e518c68059babd9831f19cde05b" nocase wide ascii
        $key_pattern = "67e60" nocase  // Partial match for speed

    condition:
        $key_hex or (all of ($key_pattern*))
}

Rule 3: Campaign and Version Identifier Detection

rule arsenal_237_campaign_identifiers {
    meta:
        description = "Detects Arsenal-237 campaign ID and version strings"
        author = "The Hunters Ledger"
        date = "2026-01-26"
        severity = "CRITICAL"
        ioc_type = "Campaign Identifier"

    strings:
        $campaign_id = "ICIIXGD1X8ZJ4T1MTQ6TLQIDJEMDE7U4" wide ascii
        $version = "v0.5-beta" wide ascii
        $ransom_task = "RustRansomNoteTask" wide ascii

    condition:
        any of them
}

Rule 4: Veritas Backup Exec Agent Targeting Detection

rule arsenal_237_veritas_targeting {
    meta:
        description = "Detects service names targeting Veritas Backup Exec agents"
        author = "The Hunters Ledger"
        date = "2026-01-26"
        severity = "CRITICAL"
        ioc_type = "Enterprise Targeting Indicator"
        confidence = "CONFIRMED"

    strings:
        $gxvss = "GxVss" wide ascii
        $gxblr = "GxBlr" wide ascii
        $gxfwd = "GxFWD" wide ascii
        $gxcvd = "GxCVD" wide ascii
        $gxcimgr = "GxCIMgr" wide ascii
        $veeam = "veeam" wide ascii nocase

    condition:
        (3 of ($gx*)) or $veeam
}

Rule 5: Anti-Recovery Command Detection

rule arsenal_237_antirecovery_commands {
    meta:
        description = "Detects VSS deletion and anti-recovery commands"
        author = "The Hunters Ledger"
        date = "2026-01-26"
        severity = "CRITICAL"
        ioc_type = "Anti-Recovery Indicator"

    strings:
        $vss_delete = "vssadmin delete shadows /all /quiet" wide ascii nocase
        $vss_pattern = "vssadmin" wide ascii nocase
        $delete_shadows = "delete shadows" wide ascii nocase

    condition:
        ($vss_delete) or ($vss_pattern and $delete_shadows)
}

Rule 6: Anti-Analysis Technique Detection

rule arsenal_237_anti_analysis {
    meta:
        description = "Detects anti-analysis strings and VM detection indicators"
        author = "The Hunters Ledger"
        date = "2026-01-26"
        severity = "HIGH"
        ioc_type = "Anti-Analysis Indicator"

    strings:
        $vm_vbox = "VBOX" wide ascii nocase
        $vm_vmware = "VMWARE" wide ascii nocase
        $vm_qemu = "QEMU" wide ascii nocase
        $vm_xen = "XEN" wide ascii nocase
        $vm_hyperv = "HYPERV" wide ascii nocase
        $sandbox_cuckoo = "cuckoo" wide ascii nocase
        $sandbox_malware = "malware" wide ascii nocase
        $bios_registry = "HARDWARE\\\\DESCRIPTION\\\\System\\\\BIOS" wide ascii nocase
        $debugger_check = "IsDebuggerPresent" wide ascii

    condition:
        (3 of ($vm_*)) or (2 of ($sandbox_*)) or $bios_registry or $debugger_check
}

Rule 7: Hex-Encoded Ransom Note Detection

rule arsenal_237_hex_ransom_note {
    meta:
        description = "Detects hex-encoded ransom note header"
        author = "The Hunters Ledger"
        date = "2026-01-26"
        severity = "HIGH"
        ioc_type = "Ransom Note Indicator"

    strings:
        $hex_header = "76302e352d626574610d0a0d0a52616e736f6d2d4944" wide ascii  // v0.5-beta\r\n\r\nRansom-ID

    condition:
        $hex_header
}

Rule 8: Analysis Tool Process Monitoring

rule arsenal_237_analysis_tool_strings {
    meta:
        description = "Detects strings indicating analysis tool process monitoring"
        author = "The Hunters Ledger"
        date = "2026-01-26"
        severity = "HIGH"
        ioc_type = "Anti-Analysis Tool Detection"

    strings:
        $procmon = "procmon" wide ascii nocase
        $wireshark = "wireshark" wide ascii nocase
        $x64dbg = "x64dbg" wide ascii nocase
        $ida = "ida" wide ascii nocase
        $ghidra = "ghidra" wide ascii nocase
        $dnspy = "dnspy" wide ascii nocase
        $fiddler = "fiddler" wide ascii nocase
        $processhacker = "processhacker" wide ascii nocase

    condition:
        (5 of them)
}

Rule 9: Rust Ransomware Family Detection

rule arsenal_237_rust_implementation {
    meta:
        description = "Detects Rust-compiled ransomware characteristics"
        author = "The Hunters Ledger"
        date = "2026-01-26"
        severity = "HIGH"
        ioc_type = "Family Classification"

    strings:
        $chacha_const = "Chacha_256_constant" wide ascii
        $rust_std = "core::panicking" wide ascii
        $cargo = "cargo" wide ascii

    condition:
        (2 of them)
}

Sigma Rules

Rule 1: VSS Deletion Command Execution

title: Volume Shadow Copy Deletion - Ransomware Indicator
id: 0d6cbe7c-6d5f-4b6e-9c2a-8c4b5d3e1f7a
description: Detects execution of vssadmin delete shadows command used by ransomware
status: test
date: 2026-01-26
author: The Hunters Ledger
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains|all:
            - 'vssadmin'
            - 'delete'
            - 'shadows'
    filter:
        CommandLine|contains:
            - 'VSSADMIN_DELETE_SHADOWS'  # Legitimate admin activity
    condition: selection and not filter
falsepositives:
    - Legitimate administrative backup operations
level: critical
tags:
    - attack.impact
    - attack.t1490
    - detection.emerging-threats

Rule 2: Backup Service Termination Pattern

title: Backup Service Termination - Multiple Services
id: 1e8c3d5a-2b7f-4a9c-b1e6-d3f5a8c2b4e7
description: Detects termination of a backup-related service (Veritas, Veeam, VSS) via the Service Control Manager. The original rule intent required 3+ distinct backup services to stop within 5 minutes; single-event Sigma rules cannot express this volumetric/multi-event threshold, so it has been dropped — this rule now fires on any single matching service stop and should be correlated with other backup-service terminations in the same timeframe at review time.
status: test
date: 2026-01-26
author: The Hunters Ledger
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7036
        Provider_Name: 'Service Control Manager'
        param1|contains:
            - 'GxVss'
            - 'GxBlr'
            - 'GxFWD'
            - 'GxCVD'
            - 'GxCIMgr'
            - 'veeam'
            - 'vss'
        param2: 'stopped'
    condition: selection
falsepositives:
    - Legitimate service maintenance
    - Scheduled backup system restarts
level: high
tags:
    - attack.impact
    - attack.t1489
    - detection.emerging-threats

Rule 3: Scheduled Task Creation - Ransom Note

title: Scheduled Task Creation - RustRansomNoteTask
id: 3f7a9b2c-5e8d-4c1a-b6f3-7d2e5a8c1b9f
description: Detects creation of RustRansomNoteTask scheduled task
status: test
date: 2026-01-26
author: The Hunters Ledger
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: 'RustRansomNoteTask'
    condition: selection
falsepositives:
    - Legitimate system tasks with similar naming
level: high
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1053.005
    - detection.emerging-threats

Rule 4: Database Service Termination Pattern

title: Database Service Termination - Ransomware Pattern
id: 4b2d7e9a-1c5f-3a8b-6d4e-2f7c9a3b5e1d
description: Detects termination of a SQL Server or Oracle database service via the Service Control Manager. The original rule intent required 2+ distinct database services to stop within 10 minutes; single-event Sigma rules cannot express this volumetric/multi-event threshold, so it has been dropped — this rule now fires on any single matching service stop and should be correlated with other database-service terminations in the same timeframe at review time.
status: test
date: 2026-01-26
author: The Hunters Ledger
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7036
        Provider_Name: 'Service Control Manager'
        param1|contains:
            - 'sql'
            - 'oracle'
            - 'ocssd'
            - 'dbsnmp'
            - 'sqlservr'
        param2: 'stopped'
    condition: selection
falsepositives:
    - Legitimate database maintenance
    - Scheduled database restarts
level: medium
tags:
    - attack.impact
    - attack.t1489
    - detection.emerging-threats

Detection Queries

KQL (Azure Sentinel / Microsoft Defender for Endpoint)

Query 1: VSS Deletion Detection

DeviceProcessEvents
| where ProcessCommandLine contains ("vssadmin" and "delete") or ProcessCommandLine contains "shadowcopy"
| where ProcessName != "explorer.exe"  // Filter out false positives
| project Timestamp, DeviceId, DeviceName, InitiatingProcessName, ProcessName, ProcessCommandLine, InitiatingProcessIntegrityLevel
| order by Timestamp desc

Alert Configuration:

• Severity: CRITICAL
• Trigger: 1 or more matches in 1 hour
• Response: Immediate isolation of affected device

Query 2: Backup Service Termination Hunt

DeviceProcessEvents
| where ProcessName in~ ("net.exe", "sc.exe", "taskkill.exe")
| where ProcessCommandLine contains any ("GxVss", "GxBlr", "GxFWD", "GxCVD", "GxCIMgr", "veeam", "vss")
| where ProcessCommandLine contains ("stop", "disable", "delete")
| project Timestamp, DeviceId, DeviceName, InitiatingProcessName, ProcessCommandLine
| order by Timestamp desc

Alert Configuration:

• Severity: CRITICAL
• Trigger: 1 or more matches
• Response: Verify backup system status immediately

Query 3: Veritas Backup Exec Agent Targeting

DeviceProcessEvents
| where ProcessName in~ ("net.exe", "sc.exe", "powershell.exe")
| where ProcessCommandLine matches regex @"(GxVss|GxBlr|GxFWD|GxCVD|GxCIMgr)"
| project Timestamp, DeviceId, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine
| order by Timestamp desc

Alert Configuration:

• Severity: CRITICAL
• Context: Enterprise backup targeting indicator

Query 4: Scheduled Task Creation - Ransom Note

DeviceProcessEvents
| where ProcessName =~ "schtasks.exe"
| where ProcessCommandLine contains "RustRansomNoteTask" or ProcessCommandLine contains "Ransom"
| project Timestamp, DeviceId, DeviceName, ProcessCommandLine, InitiatingProcessName
| order by Timestamp desc

Alert Configuration:

• Severity: HIGH
• Trigger: 1 or more matches
• Indicator: Post-encryption persistence mechanism

Query 5: Multi-Service Termination Pattern (Ransomware Signature)

let ServiceStops =
    DeviceProcessEvents
    | where ProcessName in~ ("net.exe", "sc.exe", "powershell.exe")
    | where ProcessCommandLine contains any ("stop", "disable")
    | where ProcessCommandLine contains any ("sql", "oracle", "vss", "veeam", "backup", "sophos", "msexchange");
ServiceStops
| summarize ServiceCount = dcount(ProcessCommandLine) by DeviceId, bin(Timestamp, 15m)
| where ServiceCount > 3
| project Timestamp, DeviceId, ServiceCount

Alert Configuration:

• Severity: HIGH
• Pattern: 4+ different services stopped within 15 minutes

SPL (Splunk)

Query 1: VSS Deletion Detection

index=main sourcetype=WinEventLog:System OR sourcetype=XmlWinEventLog:System
(CommandLine="vssadmin delete shadows*" OR ProcessImage="*vssadmin.exe" AND CommandLine="*delete*" AND CommandLine="*shadows*")
| table _time, host, user, CommandLine, Image, ParentImage
| stats count by host
| where count > 0

Query 2: Service Termination - Critical Backup Services

index=main sourcetype=WinEventLog:System
(ServiceName=GxVss OR ServiceName=GxBlr OR ServiceName=GxFWD OR ServiceName=GxCVD OR ServiceName=GxCIMgr OR ServiceName=veeam OR ServiceName=vss)
AND (Status=stopped OR EventCode=7000)
| timechart count by ServiceName
| search count > 0

Alert Configuration:

alert_condition: if(count > 0)
alert_type: critical
alert_name: "Backup Service Termination - Arsenal-237 Indicator"

Query 3: Scheduled Task Creation - RustRansomNoteTask

index=main sourcetype=WinEventLog:System EventCode=4698
TaskName="*RustRansomNoteTask*"
| table _time, host, TaskName, TaskContent, User

Query 4: Ransomware Multi-Stage Attack Pattern

index=main sourcetype=WinEventLog:System
earliest=-1h latest=now
| where (
  (ProcessImage="*vssadmin.exe" AND CommandLine="*delete*") OR
  (ServiceName IN (GxVss, GxBlr, GxFWD, GxCVD, GxCIMgr, veeam, vss)) OR
  (CommandLine="*schtasks*" AND CommandLine="*RustRansomNoteTask*")
)
| bucket _time span=10m
| stats count, dc(host) as host_count by _time
| where count > 2

Elastic Detection Rules

Rule 1: VSS Deletion Command Execution

{
  "rule": {
    "id": "vss-deletion-ransomware",
    "type": "query",
    "language": "kuery",
    "query": "process.name:vssadmin.exe AND process.command_line:(\"delete\" AND \"shadows\")",
    "index": ["logs-endpoint.events.process-*"],
    "name": "Volume Shadow Copy Deletion - Ransomware Indicator",
    "description": "Detects execution of VSS deletion commands associated with ransomware",
    "severity": "critical",
    "risk_score": 100,
    "references": ["https://attack.mitre.org/techniques/T1490/"],
    "tags": ["ransomware", "impact", "backup-targeting"]
  }
}

Rule 2: Veritas Backup Agent Termination

{
  "rule": {
    "id": "veritas-backup-termination",
    "type": "query",
    "language": "kuery",
    "query": "process.command_line:(GxVss OR GxBlr OR GxFWD OR GxCVD OR GxCIMgr) AND (net.exe OR sc.exe OR powershell.exe) AND (stop OR disable)",
    "index": ["logs-endpoint.events.process-*"],
    "name": "Veritas Backup Exec Service Termination",
    "description": "Detects termination of Veritas Backup Exec agent services",
    "severity": "critical",
    "risk_score": 99,
    "tags": ["backup-targeting", "enterprise"]
  }
}

Rule 3: Arsenal-237 Campaign Identifier

{
  "rule": {
    "id": "arsenal237-campaign-id",
    "type": "query",
    "language": "kuery",
    "query": "process.command_line:\"ICIIXGD1X8ZJ4T1MTQ6TLQIDJEMDE7U4\" OR file.name:\"ICIIXGD1X8ZJ4T1MTQ6TLQIDJEMDE7U4\"",
    "index": ["logs-endpoint.events.*"],
    "name": "Arsenal-237 Campaign Identifier Detection",
    "description": "Detects Arsenal-237 campaign identifier in process or file context",
    "severity": "critical",
    "risk_score": 100
  }
}

Network Detection Signatures

Suricata Rules

Rule 1: ChaCha20 Encryption Traffic Pattern

alert http any any -> any any (
  msg:"Arsenal-237 ChaCha20 Ransomware Encryption Pattern";
  content:"ChaCha20"; nocase;
  classtype:trojan-activity;
  sid:1000001;
  rev:1;
  priority:1;
)

Rule 2: Ransom Note Delivery Detection

alert dns any any -> any 53 (
  msg:"Arsenal-237 Ransom Note Domain Query";
  dns_query; content:"ICIIXGD1X8ZJ4T1MTQ6TLQIDJEMDE7U4";
  nocase; classtype:trojan-activity;
  sid:1000002; rev:1; priority:2;
)

Behavioral Hunting Methodology

Investigation Steps

Step 1: Identify Candidate Systems

1. Query for VSS deletion commands
2. Check for backup service termination patterns
3. Search for scheduled task creation matching pattern
4. Look for diagnostic tool execution patterns

Step 2: Verify Infection

1. Confirm presence of new_enc.exe file
2. Validate file hash against known samples
3. Check for RustRansomNoteTask scheduled task
4. Review event logs for anti-analysis evasion patterns

Step 3: Assess Impact Scope

1. Identify all affected systems
2. Determine encryption scope and file count
3. Verify backup system status
4. Assess recovery options (offline backups)

Step 4: Determine Recovery Path

1. Validate offline backup integrity
2. Assess rebuild vs. aggressive cleanup decision
3. Initiate forensic analysis if required
4. Plan recovery execution timeline

Detection Confidence Levels

Implementation Recommendations

Priority 1: Immediate Deployment (Critical Rules)

• VSS Deletion Detection
• Veritas Backup Agent Termination
• File Hash Detection
• Campaign Identifier Detection

Priority 2: Near-Term Deployment (High-Confidence Rules)

• Scheduled Task Creation
• Database Service Termination Pattern
• Multi-Service Termination Pattern

Priority 3: Ongoing Monitoring (Supporting Rules)

• Anti-Analysis Technique Detection
• Rust Implementation Characteristics
• Behavioral Pattern Matching

Fine-Tuning Recommendations

1. Adjust alert thresholds based on organizational baseline
2. Implement time-window correlation for multi-event patterns
3. Create custom alert response playbooks for each rule
4. Establish baseline for normal service termination activity
5. Document false positive patterns and refine filters
6. Regular rule validation against new/modified samples

End of Detection Rules Document

License

Detection rules are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Free to use, including commercially, with attribution to The Hunters Ledger.