Rule to detect Locdoor/DryCry

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the Locdoor or DryCry malware families to establish persistent footholds within the environment through specific execution patterns. The SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage compromises before they escalate into more severe incidents, despite their current low severity classification.

YARA Rule

rule locdoor_ransomware {

   meta:

      description = "Rule to detect Locdoor/DryCry"
      author = "Marc Rivero | @seifreed"
      reference = "https://twitter.com/leotpsc/status/1036180615744376832"

   strings:

      $s1 = "copy \"Locdoor.exe\" \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\temp00000000.exe\"" fullword ascii
      $s2 = "copy wscript.vbs C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\wscript.vbs" fullword ascii
      $s3 = "!! Your computer's important files have been encrypted! Your computer's important files have been encrypted!" fullword ascii
      $s4 = "echo CreateObject(\"SAPI.SpVoice\").Speak \"Your computer's important files have been encrypted! " fullword ascii    
      $s5 = "! Your computer's important files have been encrypted! " fullword ascii
      $s7 = "This program is not supported on your operating system." fullword ascii
      $s8 = "echo Your computer's files have been encrypted to Locdoor Ransomware! To make a recovery go to localbitcoins.com and create a wa" ascii
      $s9 = "Please enter the password." fullword ascii

   condition:

      ( uint16(0) == 0x5a4d and filesize < 600KB ) and all of them 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• https://twitter.com/leotpsc/status/1036180615744376832
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Locdoor/DryCry detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Antivirus Database Updates via Local Service Accounts

  • Scenario: The LocalSystem or a dedicated service account (e.g., svc_antivirus) triggers the Locdoor/DryCry signature during nightly maintenance windows when updating virus definition databases. This activity often involves high-frequency file I/O and process spawning that mimics the behavior of the targeted threat, particularly if the update mechanism utilizes local temporary directories similar to those monitored by DryCry.
  • Filter/Exclusion: Create an exclusion for processes running under specific service accounts (NT AUTHORITY\LOCAL SERVICE, svc_antivirus) originating from known vendor paths (e.g., C:\Program Files\McAfee\* or C:\Program Files\Symantec\*). Additionally, exclude events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Enterprise Software Deployment via SCCM/MECM

  • Scenario: During a mass deployment of enterprise applications using Microsoft Endpoint Configuration Manager (SCCM) or Intune, the ccmexec.exe process executes local scripts and installs packages. These operations often involve creating temporary files, modifying registry keys, and launching child processes that match the Locdoor heuristic for legitimate software installation but are flagged as potential DryCry activity due to their localized execution scope.
  • Filter/Exclusion: Exclude events where the parent process is ccmexec.exe or msiexec.exe running under the System context. Filter specifically for file paths located within the standard deployment directories (e.g., C:\Windows\CCMCache\* or `C:\Program Files\Microsoft Intune Management Extension