id: petya-malware-variant-3

info:
  name: Petya Malware (Variant 3) - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/airbnb/binaryalert/blob/master/rules/public/ransomware/windows/ransomware_windows_petya_variant_3.yara
  tags: malware,file,petya

file:
  - extensions:
      - all

    matchers:
      - type: word
        part: raw
        words:
          - "wevtutil cl Setup & wevtutil cl System"
          - "fsutil usn deletejournal /D %c:"
        condition: or