DeadLock Ransomware — Rust-Based Encryptor with Decentralized Recovery Infrastructure

Looks for: exact-hash execution of the confirmed DeadLock encryptor sample. FP: none expected — exact hash match on a confirmed malicious sample.

// HUNT: DeadLock Ransomware - Known Encryptor Hash Execution
// HYPOTHESIS: If the published DeadLock encryptor sample has executed, ProcessRollup2/SyntheticProcessRollup2 will show this exact SHA256.
// MITRE: T1486 (Data Encrypted for Impact)
// CONF: high  FP: low  COST: low | REQUIRES: Falcon sensor process visibility
// FP NOTES: None expected - exact hash match on a confirmed malicious sample.
// LOOKBACK: 30d (extend to 1y for retrospective hunt)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| SHA256HashData = "a1fdf65020ce4a0f0940c793c6425baf8a0b994ec48b9baaf72788661a9d29f4"
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: a burst of files renamed to the .dlock extension on one host. FP: legitimate backup/archival tools that bulk-append a custom extension (rare); AV/EDR test harnesses.

// HUNT: DeadLock Ransomware - Mass .dlock File Encryption Sweep
// HYPOTHESIS: If DeadLock is actively encrypting a host, RansomwareOpenFile events will show a burst of files renamed with the .dlock extension in a short window.
// MITRE: T1486 (Data Encrypted for Impact)
// CONF: high  FP: medium  COST: medium | REQUIRES: Falcon Ransomware Protection telemetry (RansomwareOpenFile)
// FP NOTES: Legitimate backup/archival tools that append a custom extension in bulk (rare); AV/EDR test harnesses.
// TUNING: Exclude known backup-agent process names once the FileName field is confirmed against a sample event in your tenant - field availability on RansomwareOpenFile varies by sensor version.
// LOOKBACK: 24h - this is a live-encryption detector, keep the window tight
#event_simpleName=RansomwareOpenFile
| FileName = /\.dlock$/
| groupBy([aid, ComputerName, UserName], function=[count(as=FilesTouched), collect(FileName, limit=5)], limit=1000)
| FilesTouched > 20
| sort(FilesTouched, order=desc)

Looks for: HOW_RECOVER.<UID>.txt or RECOVERY_CHAT.<UID>.html being written. FP: none expected — filename prefixes are specific to this family.

// HUNT: DeadLock Ransomware - Ransom Note Artifact Drop
// HYPOTHESIS: If DeadLock completed a directory sweep, HOW_RECOVER.<UID>.txt and/or RECOVERY_CHAT.<UID>.html will have been written to encrypted directories, drive roots, and Desktop folders.
// MITRE: T1486 (Data Encrypted for Impact)
// CONF: high  FP: low  COST: low | REQUIRES: Falcon Ransomware Protection telemetry (RansomwareOpenFile) - validate FileName is populated for non-PE writes in your tenant
// FP NOTES: None expected - the HOW_RECOVER / RECOVERY_CHAT filename pattern is specific to this family.
// LOOKBACK: 30d
#event_simpleName=RansomwareOpenFile
| FileName = /^(HOW_RECOVER\..+\.txt|RECOVERY_CHAT\..+\.html)$/i
| table([@timestamp, aid, ComputerName, UserName, FileName])
| sort(@timestamp, order=desc)

Looks for: an 8-character all-uppercase .cmd file execution (e.g. ESYEKQSY.cmd). FP: some installer frameworks (NSIS, InstallShield, Squirrel) and RMM tools generate randomly-named temp .cmd/.bat files.

// HUNT: DeadLock Ransomware - UAC Bypass via Randomly-Named .cmd Elevation
// HYPOTHESIS: If DeadLock attempted privilege elevation from a non-elevated context, it generated and executed an 8-uppercase-letter .cmd file via ShellExecuteW with the RunAs verb.
// MITRE: T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control)
// CONF: medium  FP: medium  COST: low | REQUIRES: Falcon sensor process visibility
// FP NOTES: Some installer frameworks (NSIS, InstallShield, Squirrel) and RMM tools generate randomly-named temp .cmd/.bat files; the strict 8-char ALL-UPPERCASE pattern narrows this but should still be validated per tenant.
// TUNING: Cross-reference hits against known installer/RMM parent processes (ParentBaseFileName) before treating as high confidence; add an exclusion for your packaging/RMM tool's temp-file naming convention if it collides.
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^[A-Z]{8}\.cmd$/
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

Looks for: 3+ of a specific service set disabled via registry on one host in a short window (WinDefend, vss, swprv, wbengine, mssearch, vmcompute, vmms, ADWS, NTDS, kdc). FP: patch/imaging tools and GPO service-hardening scripts can touch multiple Start values during a maintenance window.

// HUNT: DeadLock Ransomware - Mass Service Disablement via Service Start-Type Registry Change
// HYPOTHESIS: If DeadLock is in its pre-encryption phase, it will set the Start registry value to disabled for Defender, VSS/backup, Hyper-V, and AD services in quick succession on one host before stopping them via the Service Control Manager.
// MITRE: T1489 (Service Stop), T1562.001 (Impair Defenses), T1490 (Inhibit System Recovery)
// CONF: high  FP: medium  COST: medium | REQUIRES: Falcon registry telemetry (RegGenericValueUpdate/AsepValueUpdate)
// FP NOTES: Patch/imaging tools, GPO service-hardening scripts, and legitimate service-decommission projects can touch multiple Start values in a maintenance window.
// TUNING: Raise the ServicesTouched threshold or add a maintenance-window/process exclusion if your environment runs bulk service reconfiguration scripts; investigate any hit where WinDefend is one of the matched services regardless of count.
// LOOKBACK: 7d
#event_simpleName=/RegGenericValueUpdate|AsepValueUpdate/
| RegObjectName = /CurrentControlSet\\Services\\(WinDefend|vss|swprv|wbengine|mssearch|vmcompute|vmms|ADWS|NTDS|kdc)\\Start$/i
| RegValueName = "Start"
| groupBy([aid, ComputerName, UserName], function=[count(as=ServicesTouched), collect(RegObjectName, limit=10)], limit=1000)
| ServicesTouched >= 3
| sort(ServicesTouched, order=desc)

Looks for: 3+ WINEVT log channels disabled via registry on one host in a short window. FP: rare — a security team deliberately disabling a noisy custom diagnostic channel.

// HUNT: DeadLock Ransomware - Windows Event Log Channel Tampering (Anti-Forensics)
// HYPOTHESIS: If DeadLock is suppressing forensic evidence, it will write Enabled=0 under the WINEVT\Channels registry tree across many channels in a short window.
// MITRE: T1070.001 (Clear Windows Event Logs), T1562.002 (Disable Windows Event Logging)
// CONF: high  FP: low  COST: medium | REQUIRES: Falcon registry telemetry (RegGenericValueUpdate)
// FP NOTES: Rare legitimate case - a security team intentionally disabling a noisy/custom diagnostic channel. Investigate any hit; very low legitimate baseline.
// LOOKBACK: 7d
#event_simpleName=RegGenericValueUpdate
| RegObjectName = /WINEVT\\Channels\\.*\\Enabled$/i
| RegStringValue = "0"
| groupBy([aid, ComputerName, UserName], function=[count(as=ChannelsDisabled), collect(RegObjectName, limit=10)], limit=1000)
| ChannelsDisabled >= 3
| sort(ChannelsDisabled, order=desc)

Looks for: registration of a custom DefaultIcon for the .dlock extension. FP: none expected — no legitimate software uses this extension.

// HUNT: DeadLock Ransomware - Custom Icon Association for .dlock Extension
// HYPOTHESIS: If DeadLock branded encrypted files, it registered a custom .ico as the DefaultIcon for the .dlock extension under HKLM\SOFTWARE\Classes.
// MITRE: T1486 (Data Encrypted for Impact) [artifact], T1112 (Modify Registry)
// CONF: high  FP: low  COST: low | REQUIRES: Falcon registry telemetry (RegGenericValueUpdate/AsepValueUpdate)
// FP NOTES: None expected - the .dlock extension is not used by any known legitimate software.
// LOOKBACK: 30d
#event_simpleName=/RegGenericValueUpdate|AsepValueUpdate/
| RegObjectName = /SOFTWARE\\Classes\\\.dlock\\DefaultIcon/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc)

Looks for: the desktop wallpaper key being set to a C:\ProgramData\<UID>.bmp path. FP: legitimate GPO-enforced corporate wallpaper deployment writes the same key.

// HUNT: DeadLock Ransomware - Ransom Wallpaper Registry Change
// HYPOTHESIS: If DeadLock completed encryption, it wrote a custom BMP under C:\ProgramData\<UID>.bmp and set it as the desktop wallpaper via the Policies\System registry key.
// MITRE: T1491.001 (Defacement: Internal Defacement)
// CONF: medium  FP: medium  COST: low | REQUIRES: Falcon registry telemetry (RegGenericValueUpdate)
// FP NOTES: Legitimate GPO-enforced corporate wallpaper deployment writes the same key; DeadLock's value is distinguished by pointing at a ProgramData path rather than a managed image share.
// TUNING: Add an exclusion for your organization's approved wallpaper deployment path (e.g. a managed branding file share) so only ProgramData-sourced values alert.
// LOOKBACK: 30d
#event_simpleName=RegGenericValueUpdate
| RegObjectName = /CurrentVersion\\Policies\\System\\Wallpaper$/i
| RegStringValue = /^C:\\ProgramData\\[^\\]+\.bmp$/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegStringValue])
| sort(@timestamp, order=desc)

Looks for: DNS requests to the six public Polygon RPC endpoints the recovery-chat HTML cycles through. FP: these are legitimate, widely-used public RPC providers (MetaMask, dApps, crypto wallets, developers). Context only — never alert on this alone.

// HUNT: DeadLock Ransomware - DNS to Polygon Public RPC Endpoints (Decentralized C2 Rendezvous)
// HYPOTHESIS: If a victim's browser opened the DeadLock RECOVERY_CHAT.<UID>.html file, it will query one of the six public Polygon RPC endpoints the recovery chat cycles through to resolve the current proxy address.
// MITRE: T1102.002 (Web Service: Bidirectional Communication) - analyst inference; blockchain-as-config-store has no dedicated ATT&CK sub-technique as of this writing
// CONF: low  FP: high  COST: low | REQUIRES: Falcon DNS telemetry (DnsRequest)
// FP NOTES: These are legitimate, widely-used public Polygon RPC providers (MetaMask, dApps, crypto wallets, and developers all query them routinely). This query is CONTEXT ONLY - a hit is not evidence of compromise by itself.
// TUNING: Do not alert on this query alone. Suppress hosts with a documented business reason for blockchain/crypto RPC traffic and only escalate when it co-occurs with Q2/Q3/Q5 on the same host within the same 24h window.
// LOOKBACK: 24h
#event_simpleName=DnsRequest
| DomainName = /^(polygon-bor-rpc\.publicnode\.com|polygon\.drpc\.org|polygon-pokt\.nodies\.app|polygon-rpc\.com|1rpc\.io|polygon\.meowrpc\.com)$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName])
| sort(@timestamp, order=desc)