Detects NominatusCrypto DOS executable variant

Family: NominatusCrypto,NominatusStorm

NominatusCrypto aka NominatusStorm is a ransomware written in C#.

Detect executables referencing public and free service interface testing and dev services as means o

Detects JS potentially executing WMI queries

Detects Windows executables referencing non-Windows User-Agents

Detects command variations typically used by ransomware

Detects executables (downlaoders) containing URLs to raw contents of a paste

Detects executables Discord URL observed in first stage droppers

Detects executables containing URLs to raw contents of a Github gist

Detects executables containing many references to VEEAM. Observed in ransomware

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables referencing many IR and analysis tools

Detects executables using attrib with suspicious attributes attributes

Detects files referencing the transfer.sh file sharing website