mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
68 lines
2.3 KiB
YAML
68 lines
2.3 KiB
YAML
name: Ransomware Notes bulk creation
|
|
id: eff7919a-8330-11eb-83f8-acde48001122
|
|
version: 1
|
|
date: '2021-03-12'
|
|
author: Teoderick Contreras
|
|
type: batch
|
|
datamodel:
|
|
- Endpoint
|
|
description: The following analytics identifies a big number of instance of ransomware
|
|
notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This
|
|
behavior is a good sensor if the ransomware note filename is quite new for security
|
|
industry or the ransomware note filename is not in your ransomware lookup table
|
|
list for monitoring.
|
|
search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time
|
|
span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename)
|
|
as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer
|
|
Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`'
|
|
how_to_implement: You must be ingesting data that records the filesystem activity
|
|
from your hosts to populate the Endpoint file-system data model node. If you are
|
|
using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
|
|
you want to collect data.
|
|
known_false_positives: unknown
|
|
references:
|
|
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
|
|
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
|
|
tags:
|
|
analytic_story:
|
|
- Clop Ransomware
|
|
- DarkSide Ransomware
|
|
automated_detection_testing: passed
|
|
confidence: 90
|
|
context:
|
|
- source:endpoint
|
|
- stage: Impact
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-sysmon.log
|
|
impact: 90
|
|
kill_chain_phases:
|
|
- Obfuscation
|
|
message: A high frequency file creation of $file_name$ in different file path in
|
|
host $Computer$
|
|
mitre_attack_id:
|
|
- T1486
|
|
observable:
|
|
- name: Computer
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: user
|
|
type: user
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- EventCode
|
|
- file_name
|
|
- _time
|
|
- TargetFilename
|
|
- Computer
|
|
- Image
|
|
- user
|
|
risk_score: 81
|
|
security_domain: endpoint
|