mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
20 lines
1.4 KiB
YAML
20 lines
1.4 KiB
YAML
name: DarkSide Ransomware
|
|
id: 507edc74-13d5-4339-878e-b9114ded1f35
|
|
version: 2
|
|
creation_date: '2021-05-12'
|
|
modification_date: '2026-05-13'
|
|
author: Bhavin Patel, Splunk
|
|
status: production
|
|
description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
|
|
narrative: This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.
|
|
references:
|
|
- https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
|
|
- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations
|
|
category:
|
|
- Malware
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|