Ransomware

Maze

Ransomware Needs review 15 detections found

This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as ransomware-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: Maze

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0449) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Maze, Software S0449 — MITRE ATT&CK

Detection rules

Source	Rule	Status	Updated
elastic	AdFind Command Activity	production	2026-09-18
suricata	ET MALWARE MAZE Ransomware Payment Domain DNS Lookup	rev 3	2024-03-25
suricata	ET MALWARE MAZE Ransomware Payment Domain in DNS Lookup	rev 3	2024-03-25
sigma	Potential Maze Ransomware Activity	test	2023-02-13
sigma	Powershell Directory Enumeration	test	2022-03-17
snort	ET TROJAN MAZE Ransomware Payment Domain in DNS Lookup	rev 2	2020-05-08
snort	ET TROJAN MAZE Ransomware Payment Domain DNS Lookup	rev 2	2020-05-08
yara	apt_RU_MoonlightMaze_de_tool	—	—
yara	apt_RU_MoonlightMaze_cle_tool	—	—
yara	apt_RU_MoonlightMaze_xk_keylogger	—	—
yara	apt_RU_MoonlightMaze_IRIX_exploit_GEN	—	—
yara	Maze	—	—
yara	apt_RU_MoonlightMaze_customlokitools	—	—
yara	apt_RU_MoonlightMaze_encrypted_keylog	—	—
yara	apt_RU_MoonlightMaze_customsniffer	—	—