id: deadbolt-ransomware

info:
  name: Deadbolt Ransomware Detection
  author: pdteam
  severity: info
  metadata:
    max-request: 1
  tags: ransomware,deadbolt

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        words:
          - "<title>ALL YOUR FILES HAVE BEEN LOCKED BY DEADBOLT.</title>"
# digest: 4b0a00483046022100bb33286f23dc8baae69cba40cbad2cb8c1f5c4651e03a9ab0a5c4a5cfc0dd603022100badf03cdd0fae56822b99dcf874fec8b547d50293c0631cc8d9b155b42a282a6:922c64590222798bb761d5b6d8e72950