Medusa Ransomware — ABYSSWORKER BYOVD EDR-Killer

Looks for: a kernel driver named smuol.sys, or one claiming to be CSAgent.sys from outside the genuine CrowdStrike path. Accomplishes: catches ABYSSWORKER's Falcon-impersonation. FP: very low — legitimate CSAgent.sys loads only from the CrowdStrike directory.

// HUNT: ABYSSWORKER BYOVD driver load (smuol.sys / fake CSAgent.sys)
// MITRE: T1014, T1562.001, T1553.002 | CONF: high  FP: low  COST: low
// FP NOTES: genuine CSAgent.sys loads only from \CrowdStrike\ path with CS signer
#event_simpleName=/DriverLoad|KernelModuleLoad|ModuleLoadFromMemory/
| (FileName=/^smuol\.sys$/i
   or (FileName=/^csagent\.sys$/i and ImageFileName!=/\\CrowdStrike\\/i))
| table([@timestamp, ComputerName, FileName, ImageFileName, SHA256HashData], limit=200)

Looks for: a kernel-mode service registered pointing at a driver in a user/temp path (the BYOVD install). FP: some legit driver installs — flag user-writable paths + correlate to Q1.

// HUNT: kernel-driver service install from a user/temp path (BYOVD)
// MITRE: T1543.003, T1068 | CONF: med-high  FP: low-med  COST: low
// TUNING: flag ImagePath -> .sys in %TEMP%/%AppData%/ProgramData; correlate to Q1
#event_simpleName=/ServiceStarted|ServiceImagePath|RegSystemConfigValueUpdate/
| RegStringValue=/\\(Temp|AppData|ProgramData|Users)\\.+\.sys$/i
| table([@timestamp, ComputerName, ServiceName, RegStringValue], limit=200)

Looks for: security-product processes ending unexpectedly (ABYSSWORKER kernel kill). FP: normal updates/restarts — correlate to Q1/Q2 on the same host and watch for clusters.

// HUNT: EDR/AV process termination around a driver load
// MITRE: T1562.001 | CONF: medium  FP: medium  COST: low
// TUNING: correlate to Q1/Q2 on the same host; alert on clusters of sensor death
#event_simpleName=EndOfProcess
| FileName=/^(MsMpEng|SenseIR|MsSense|CSFalconService|elastic-endpoint|ekrn|avp|SentinelAgent|xagt|cb)\.exe$/i
| table([@timestamp, ComputerName, FileName, ImageFileName], limit=200)

Looks for: an unsigned/odd binary in a user/temp path writing a .sys file (the loader dropping the driver). FP: correlate with Q1/Q2; flag user-path PE writing a driver.

// HUNT: loader dropping a kernel driver (HEARTCRYPT stage)
// MITRE: T1105, T1027 | CONF: medium  FP: medium  COST: low
// TUNING: flag a user/temp-path process writing a .sys; correlate to Q1/Q2
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| TargetFileName=/\\(Temp|AppData|ProgramData|Users)\\.+\.sys$/i
| table([@timestamp, ComputerName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)

Looks for: shadow-copy deletion / boot-recovery disable (pre-encryption). Accomplishes: a high-fidelity late-stage ransomware signal. FP: low — rare outside admin maintenance.

// HUNT: shadow-copy deletion / recovery inhibition (pre-encryption)
// MITRE: T1490 | CONF: high  FP: low  COST: low
// FP NOTES: rare outside admin maintenance; treat as critical with Q1-Q3
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ((FileName=/^(vssadmin|wmic|diskshadow)\.exe$/i and CommandLine=/(delete|shadowcopy|shadows)/i)
   or (FileName=/^bcdedit\.exe$/i and CommandLine=/(recoveryenabled|bootstatuspolicy)/i)
   or (FileName=/^wbadmin\.exe$/i and CommandLine=/delete/i))
| table([@timestamp, ComputerName, UserName, FileName, CommandLine], limit=200)

Looks for: ransom-note files / .medusa extension writes. Accomplishes: confirms detonation. FP: medium — tune note filenames to current Medusa intel.

// HUNT: Medusa encryptor / ransom-note canary
// MITRE: T1486 | CONF: medium  FP: medium  COST: med
// TUNING: tune note filename + extension to current Medusa intel
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| TargetFileName=/(\.medusa$|!READ_ME_MEDUSA!|MEDUSA.+README.+\.html?$)/i
| table([@timestamp, ComputerName, TargetFileName], limit=200)