rule Linux_Ransomware_Esxiargs_75a8ec04
{
	meta:
		author = "Elastic Security"
		id = "75a8ec04-c41d-4702-94fa-976870762aaf"
		fingerprint = "279259c7ca41331b09842c2221139d249d6dfe2e2cb6b27eb50af7be75120ce4"
		creation_date = "2023-02-09"
		last_modified = "2024-02-13"
		threat_name = "Linux.Ransomware.Esxiargs"
		reference_sample = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
		severity = 100
		arch_context = "x86"
		scan_context = "file, memory"
		license = "Elastic License v2"
		os = "linux"

	strings:
		$s1 = "number of MB in encryption block"
		$s2 = "number of MB to skip while encryption"
		$s3 = "get_pk_data: key file is empty"
		$s4 = { 6F 70 65 6E 00 6C 73 65 65 6B 20 5B 65 6E 64 5D 00 6F 70 65 6E 5F 70 6B 5F 66 69 6C 65 }
		$s5 = "[<enc_step>] [<enc_size>] [<file_size>]"

	condition:
		3 of them
}