Detects The Gentlemen ransomware Windows locker (Storm-2697), a self-propagating Go-based encryptor

Hunt Hypothesis

This hunt hypothesis targets the specific execution patterns of The Gentlemen ransomware’s self-propagating Go-based encryptor to identify early-stage Windows locker activity before widespread file encryption occurs. Proactively hunting for this behavior in Azure Sentinel is critical due to its high severity and unique propagation mechanism, which allows adversaries to rapidly compromise environments before traditional signature-based detections trigger.

YARA Rule

rule MAL_RANSOM_Gentlemen_Jun26_1 {
   meta:
      description = "Detects The Gentlemen ransomware Windows locker (Storm-2697), a self-propagating Go-based encryptor"
      author = "Aryu-RU"
      reference = "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"
      date = "2026-06-16"
      hash1 = "22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67"
      hash2 = "f918535f974591ef031bd0f30a8171e3da27a6754e6426a8ba095f83195661c8"
      score = 80
      id = "e93ade6d-c558-426c-b8b5-c6034baf6693"
   strings:
      $x1 = "README-GENTLEMEN.txt" ascii      /* ransom note dropped into each encrypted directory */
      $x2 = "gentlemen.bmp" ascii             /* wallpaper dropped to %TEMP% and set as desktop background */
      $x3 = "gentlemen_system" ascii          /* scheduled task created for privilege escalation */

      $s1 = "[+] Encryption started" ascii    /* locker console output */
      $s2 = "Encrypt only mapped" ascii       /* '--shares' run option */
      $s3 = "Silent mode" ascii               /* '--silent' run option */
   condition:
      uint16(0) == 0x5A4D and filesize < 30MB
      and (
         2 of ($x*)
         or ( 1 of ($x*) and 2 of ($s*) )
      )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects The Gentlemen ransomware Windows locker (Storm-2697) rule, including suggested filters and exclusions:

Scenario: Go-based Backup Agents Performing File Encryption
- Context: Enterprise backup solutions like Veeam Agent, Rubrik, or custom internal tools built with the Go language often encrypt local data snapshots. Since The Gentlemen is a Go-based encryptor, these legitimate backup processes can mimic the file modification patterns and binary signatures of the ransomware.
- Suggested Filter/Exclusion: Create an exclusion for processes running under specific service accounts (e.g., DOMAIN\VeeamBackupSvc) or filter out alerts where the parent process is a known backup executable (e.g., veeam.exe, rubrik-agent.exe). Additionally, exclude file paths within dedicated backup directories like C:\Veeam\Backups or D:\RubrikSnapshots.
Scenario: Scheduled Go-based Deployment Scripts
- Context: DevOps teams frequently use self-propagating deployment scripts written in Go (e.g., using tools like Ansible, Terraform, or custom CI/CD runners) to push updates across the fleet. These scripts often lock and encrypt configuration files during rollout, triggering the “self-propagating” logic of the detection rule.
- Suggested Filter/Exclusion: Implement a time-based exclusion for alerts occurring during known maintenance windows (e.g., 02:00–04:00 UTC). Furthermore, exclude processes where the command line arguments contain specific deployment keywords such as --deploy, --sync, or --backup and are initiated by the Task Scheduler (svchost.exe -k netsvcs) with a known task name like “NightlyGoDeployment”.