Bad Rabbit Ransomware | SOC Hunt Feed

Hunt Hypothesis

This detection identifies potential Bad Rabbit ransomware activity by monitoring for specific execution patterns associated with its initial infection vectors and payload delivery. Proactively hunting for this behavior in Azure Sentinel is critical to validate rule efficacy against false positives and ensure early containment before lateral spread occurs within the environment.

YARA Rule

rule sig_8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93 {
   meta:
      description = "Bad Rabbit Ransomware"
      author = "Christiaan Beek"
      reference = "BadRabbit"
      date = "2017-10-24"
      hash1 = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
      source = "https://pastebin.com/Y7pJv3tK"
   strings:
      $x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST %02d:%02d:00" fullword wide
      $x2 = "need to do is submit the payment and get the decryption password." fullword ascii
      $s3 = "If you have already got the password, please enter it below." fullword ascii
      $s4 = "dispci.exe" fullword wide
      $s5 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
      $s6 = "Run DECRYPT app at your desktop after system boot" fullword ascii
      $s7 = "Enter password#1: " fullword wide
      $s8 = "Enter password#2: " fullword wide
      $s9 = "C:\\Windows\\cscc.dat" fullword wide
      $s10 = "schtasks /Delete /F /TN %ws" fullword wide
      $s11 = "Password#1: " fullword ascii
      $s12 = "\\AppData" fullword wide
      $s13 = "Readme.txt" fullword wide
      $s14 = "Disk decryption completed" fullword wide
      $s15 = "Files decryption completed" fullword wide
      $s16 = "http://diskcryptor.net/" fullword wide
      $s17 = "Your personal installation key#1:" fullword ascii
      $s18 = ".3ds.7z.accdb.ai.asm.asp.aspx.avhd.back.bak.bmp.brw.c.cab.cc.cer.cfg.conf.cpp.crt.cs.ctl.cxx.dbf.der.dib.disk.djvu.doc.docx.dwg." wide
      $s19 = "Disable your anti-virus and anti-malware programs" fullword wide
      $s20 = "bootable partition not mounted" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 400KB and
        pe.imphash() == "94f57453c539227031b918edd52fc7f1" and
        ( 1 of ($x*) or 4 of them )
      ) or ( all of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 20 string patterns in its detection logic.

References

BadRabbit
Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Bad Rabbit Ransomware detection rule in an enterprise environment, along with suggested filters or exclusions:

Antivirus Definition Updates via Windows Update Service
- Scenario: The WindowsUpdate service (or third-party agents like CrowdStrike Falcon or Symantec Endpoint Protection) executes a scheduled task to download and install the latest malware definition database. This process often involves writing multiple executable files (.dll, .exe) to the %ProgramData% or %SystemRoot%\SoftwareDistribution directories, which mimics the rapid file creation behavior of Bad Rabbit’s initial infection stage.
- Filter/Exclusion: Create an exclusion for processes running under svchost.exe with the command line containing WindowsUpdate or specific AV vendor names (e.g., CrowdStrike.exe, Symantec Antivirus). Additionally, exclude file creation events within the %SystemRoot%\SoftwareDistribution\Download and %ProgramData%\<VendorName>\Definitions paths.
Enterprise Software Deployment via SCCM/MECM
- Scenario: The Microsoft Endpoint Configuration Manager (SCCM) or Ivanti deployment engine pushes a new application package to end-user workstations. During this task, the ccmexec.exe process extracts compressed archives and writes numerous temporary files and executables to user profiles (%LocalAppData%\Temp) and system directories, triggering the “mass file creation” logic associated with ransomware encryption activities.
- Filter/Exclusion: Exclude events where the parent process is ccmexec.exe or IvantiAgent.exe. Furthermore, filter out file write operations targeting paths containing \CCMCache\, \Temp\, or specific deployment folders like \Program Files\Microsoft SCCM\.
**Scheduled Backup Operations (V