Detects ransomware files in AhnLab EPP V3 malware alert logs.

Overview

Priority	High
Type	Stream
Log schema	ahnlab-epp-v3-malware
Message	안랩 EPP V3 랜섬웨어 탐지: 호스트 $host_ip, 악성코드 $signature
Output field order	_log_time, hostname, host_ip, emp_name, dept_name, signature, file_path, file_status, md5
MITRE Techniques	T1486 Data Encrypted for Impact
MITRE tactics	TA0040 Impact

Query

The AhnLab V3 antivirus engine detects ransomware with signatures such as Ransomware/Win.Gunra.C5761824, Ransomware/Win.Hades.R374581, Trojan/Win32.ClopRansom.R356895, Ransomware/Win.BlackByte.R455522, Malware/Win32.Ransom.C4006138, Win-Trojan/Gandcrab.Exp, etc. Therefore, alerts are extracted when the signature value starts with Ransomware/ or contains .Ransom. or Gandcrab.

Target logger models

• AhnLab EPP syslog

Threat analysis

• Ransomware encrypts system files and demands payment for decryption. Even a single infected endpoint can lead to widespread disruption and significant data loss across the organization.
• In many cases, V3 may detect ransomware immediately upon file introduction, but there is still a possibility that encryption attempts, payload execution, or propagation activities have already begun on the affected endpoint.
• If file encryption by ransomware has been observed, the attack may continue with additional module installation, backup deletion, and further encryption, requiring immediate isolation and remediation.

False positives

• False positives may occur during internal ransomware simulation exercises or malware analysis testing performed by the security team.

Response actions

• Immediately isolate the affected endpoint from the network and check for ongoing encryption or abnormal file modifications.
• Review process lists, task scheduler entries, and service creation records to identify ransomware processes or related activities.
• Determine whether additional endpoints in the same user account scope or network segment show signs of infection, and investigate organization-wide spread if necessary.
• Verify backup integrity, initiate recovery procedures, and analyze the infection vector (vulnerability exploitation, spear-phishing, remote access compromise, etc.) to prevent recurrence.