BQTLock & GREENBLOOD Behavioral Hunts
This rule detects a multi-stage attack chain associated with BQTLock and GREENBLOOD ransomware. It identifies the staging of registry keys for a fodhelper UAC bypass, the subsequent execution of fodhelper.exe, the creation of run-key persistence, and the execution of processes containing the keyword 'greenblood' in their command line, indicating the final payload or related activity.
Splunk (SPL)
