mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
21 lines
1.1 KiB
YAML
21 lines
1.1 KiB
YAML
name: Ransomware Cloud
|
|
id: f52f6c43-05f8-4b19-a9d3-5b8c56da91c2
|
|
version: 2
|
|
creation_date: '2020-10-27'
|
|
modification_date: '2026-05-13'
|
|
author: Rod Soto, David Dorsey, Splunk
|
|
status: production
|
|
description: Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.
|
|
narrative: Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources.
|
|
references:
|
|
- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
|
|
- https://github.com/d1vious/git-wild-hunt
|
|
- https://www.youtube.com/watch?v=PgzNib37g0M
|
|
category:
|
|
- Malware
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|