id: deadbolt-ransomware

info:
  name: Deadbolt Ransomware Detection
  author: pdteam
  severity: info
  metadata:
    max-request: 1
  tags: ransomware,deadbolt

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        words:
          - "<title>ALL YOUR FILES HAVE BEEN LOCKED BY DEADBOLT.</title>"

# digest: 490a00463044022100f104d69295877267b348ba1c490710674957ddab61f2f4b31eaee7dfd8d789d1021f41a97e07f3369ec1f830008501991801cd63d077c964621cf6d9b4f499c0a6:922c64590222798bb761d5b6d8e72950