Rule to detect Shrug2 ransomware

Hunt Hypothesis

This hypothesis posits that adversaries are deploying Shrug2 ransomware within the Azure environment, characterized by specific file encryption patterns and process execution behaviors unique to this strain. The SOC team should proactively hunt for these indicators in Azure Sentinel to validate early-stage infections before they escalate into high-severity incidents, ensuring rapid containment despite the rule’s current low severity classification.

YARA Rule

rule shrug2_ransomware {

   meta:

      description = "Rule to detect Shrug2 ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://blogs.quickheal.com/new-net-ransomware-shrug2/"
       
   strings:

      $s1 = "C:\\Users\\Gamer\\Desktop\\Shrug2\\ShrugTwo\\ShrugTwo\\obj\\Debug\\ShrugTwo.pdb" fullword ascii
      $s2 = "http://tempacc11vl.000webhostapp.com/" fullword wide
      $s4 = "Shortcut for @ShrugDecryptor@.exe" fullword wide
      $s5 = "C:\\Users\\" fullword wide
      $s6 = "http://clients3.google.com/generate_204" fullword wide
      $s7 = "\\Desktop\\@ShrugDecryptor@.lnk" fullword wide
   
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB ) and all of them 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• https://blogs.quickheal.com/new-net-ransomware-shrug2/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Shrug2 Ransomware detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Enterprise Backup Agent File Encryption

  • Scenario: The Veeam Backup & Replication agent (running as vbrservice.exe) performs a scheduled incremental backup of the “Finance-Shared” volume. During this process, Veeam encrypts metadata files and creates temporary lock files using AES-256, which mimics the file modification patterns Shrug2 uses during its initial encryption phase.
  • Filter/Exclusion: Add an exclusion for the process path C:\Program Files\Veeam\Backup and Replication\Agent\vbrservice.exe and restrict detection to files with extensions other than common backup logs (e.g., exclude .vbk, .vrb) or limit alerts to file sizes under 50MB if Shrug2 typically targets larger documents.

• Windows Defender Scheduled Scan

  • Scenario: The daily Microsoft Defender Antivirus scan (process MsMpEng.exe) triggers a deep heuristic analysis on the “HR-Records” directory. As part of its remediation workflow, it quarantines suspicious files and rewrites their headers, generating a high volume of file write events that resemble ransomware encryption activity.
  • Filter/Exclusion: Create a rule exclusion for the process MsMpEng.exe specifically when the parent process is TaskScheduler (indicating a scheduled job). Additionally, filter out alerts where the file extension remains unchanged before and after the event (e.g., .docx to .docx), as Shrug2 typically appends unique extensions.

• Office 365 ProPlus AutoSave & Co-Authoring

  • Scenario: Multiple users simultaneously edit large Excel work