Ransomware

Conti

Ransomware Needs review 14 detections found

This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as ransomware-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: Conti

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0575) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Conti, Software S0575 — MITRE ATT&CK

Detection rules

Source	Rule	Status	Updated
sigma	Load Of RstrtMgr.DLL By An Uncommon Process	test	2026-07-28
splunk	Powershell Execute COM Object	production	2026-05-13
splunk	7zip CommandLine To SMB Share Path	production	2026-05-13
splunk	Rundll32 LockWorkStation	production	2026-05-13
splunk	Conti Common Exec parameter	production	2026-05-13
sigma	Load Of RstrtMgr.DLL By A Suspicious Process	test	2023-11-28
sigma	Potential Conti Ransomware Database Dumping Activity Via SQLCmd	test	2023-05-04
sigma	PUA - Rclone Execution	test	2023-03-05
sigma	Potential Conti Ransomware Activity	test	2023-02-13
sigma	Renamed MegaSync Execution	test	2023-02-03
sigma	Atera Agent Installation	test	2022-12-25
sigma	Conti NTDS Exfiltration Command	test	2022-10-09
sigma	Esentutl Gather Credentials	test	2022-10-09
sigma	Conti Volume Shadow Listing	test	2021-08-09