Raccine Uninstall

Title: Raccine Uninstall
Status: test
Description:Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.
References:
  -https://github.com/Neo23x0/Raccine
Author: Florian Roth (Nextron Systems)
Date: 2021-01-21
modified:2022-10-09
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection1:
    CommandLine|contains|all:
      -'taskkill '
      -'RaccineSettings.exe'

  selection2:
    CommandLine|contains|all:
      -'reg.exe'
      -'delete'
      -'Raccine Tray'

  selection3:
    CommandLine|contains|all:
      -'schtasks'
      -'/DELETE'
      -'Raccine Rules Updater'

  condition:1 of selection*
Falsepositives:
  -Legitimate deinstallation by administrative staff
Level: high