mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
tccontre
98 lines
3.2 KiB
YAML
98 lines
3.2 KiB
YAML
name: Common Ransomware Extensions
|
|
id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
|
|
version: 5
|
|
date: '2022-11-10'
|
|
author: David Dorsey, Michael Haag, Splunk, Steven Dick
|
|
type: Hunting
|
|
datamodel:
|
|
- Endpoint
|
|
description: The search looks for file modifications with extensions commonly used
|
|
by Ransomware
|
|
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime count latest(Filesystem.user) as user values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest _time span=1h
|
|
| `drop_dm_object_name(Filesystem)`
|
|
| rex field=file_name "(?<file_extension>\.[^\.]+)$"
|
|
| rex field=file_path "(?<true_file_path>([^\\\]*\\\)*).*"
|
|
| stats min(firstTime) as firstTime max(lastTime) as lastTime latest(user) as user dc(true_file_path) as path_count dc(file_name) as file_count latest(file_name) as file_name latest(true_file_path) as file_path by dest file_extension
|
|
| `security_content_ctime(lastTime)`
|
|
| `security_content_ctime(firstTime)`
|
|
| `ransomware_extensions`
|
|
| where path_count > 1 OR file_count > 20
|
|
| `common_ransomware_extensions_filter`'
|
|
how_to_implement: 'You must be ingesting data that records the filesystem activity
|
|
from your hosts to populate the Endpoint Filesystem data model node. To see the additional
|
|
metadata, add the following fields, if not already present, please review the detailed documentation on how to create a new field within Incident Review may be
|
|
found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
|
|
known_false_positives: It is possible for a legitimate file with these extensions
|
|
to be created. If this is a true ransomware attack, there will be a large number
|
|
of files created with these extensions.
|
|
references:
|
|
- https://github.com/splunk/security_content/issues/2448
|
|
tags:
|
|
Consequence: Data Destruction
|
|
analytic_story:
|
|
- SamSam Ransomware
|
|
- Ryuk Ransomware
|
|
- Ransomware
|
|
- Clop Ransomware
|
|
- Prestige Ransomware
|
|
- LockBit Ransomware
|
|
asset_type: Endpoint
|
|
cis20:
|
|
- CIS 8
|
|
confidence: 100
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Execution
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/ransom-sysmon.log
|
|
impact: 90
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack.
|
|
mitre_attack_id:
|
|
- T1485
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: file_name
|
|
type: File Name
|
|
role:
|
|
- Victim
|
|
- name: file_count
|
|
type: Other
|
|
role:
|
|
- Other
|
|
- name: path_count
|
|
type: Other
|
|
role:
|
|
- Other
|
|
- name: file_extension
|
|
type: Other
|
|
role:
|
|
- Other
|
|
- name: Name
|
|
type: Other
|
|
role:
|
|
- Other
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Filesystem.user
|
|
- Filesystem.dest
|
|
- Filesystem.file_path
|
|
- Filesystem.file_name
|
|
risk_score: 90
|
|
security_domain: endpoint
|