From 1b5bf2a065790bec699d42e41903c8c4a236dccd Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 12 May 2021 14:52:06 -0700 Subject: [PATCH] story namne --- detections/endpoint/delete_shadowcopy_with_powershell.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 25cb159580..a8dbaf0f10 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect powershell command to delete shadow copy using wmic powershell module. +description: This search is to detect powershell command to delete shadow copy using wmic powershell module. This technique was seen in darkside ransomware where it will execute a child process powershell to execute an hex encoded command to delete shadow copy. This hex encoded command was able to decrypt by powershell log. -search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" +search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -21,7 +21,7 @@ references: - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html tags: analytic_story: - - Ransomware + - DarkSide Ransomware kill_chain_phases: - Exploitation mitre_attack_id: