title: Grixba Malware Reconnaissance Activity
id: af688c76-4ce4-4309-bfdd-e896f01acf27
status: experimental
description: |
    Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations.
    This tool is used by the Play ransomware group for network enumeration, data gathering, and event log clearing.
references:
    - https://fieldeffect.com/blog/grixba-play-ransomware-impersonates-sentinelone
    - https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/
author: yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-26
tags:
    - attack.reconnaissance
    - attack.t1595.001
    - attack.discovery
    - attack.t1046
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_mode_flag:
        CommandLine|contains:
            - '-m '
            - '-mode '
            - '-m:'
            - '-mode:'
    selection_input_flag:
        CommandLine|contains:
            - '-i '
            - '-input '
            - '-i:'
            - '-input:'
    selection_scan_value:
        CommandLine|contains:
            - 'scan '
            - 'scanall '
    selection_input_options:
        CommandLine|contains:
            - ':f '
            - ':r '
            - ':s '
            - ' f '
            - ' r '
            - ' s '
    condition: all of selection_*
falsepositives:
    - Legitimate tools that use similar command-line argument structures (e.g., a tool with '--mode scan' and '--input file.txt') could trigger this rule. However, the specific combinations are indicative of reconnaissance or defense evasion.
level: high
regression_tests_path: regression_data/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon/info.yml