mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
74 lines
3.2 KiB
JSON
74 lines
3.2 KiB
JSON
{
|
|
"category": "Malware",
|
|
"channel": "ESCU",
|
|
"creation_date": "2017-07-24",
|
|
"description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.",
|
|
"id": "cf309d0d-d4aa-4fbb-963d-1e79febd3756",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-10",
|
|
"name": "Ransomware",
|
|
"narrative": "Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "davidd@splunk.com",
|
|
"name": "David Dorsey"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware",
|
|
"https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/",
|
|
"https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Backup Logs For Endpoint",
|
|
"Get Update Logs For Endpoint",
|
|
"Get Vulnerability Logs For Endpoint",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"Windows Event Log Cleared",
|
|
"Suspicious wevtutil Usage",
|
|
"USN Journal Deletion",
|
|
"Deleting Shadow Copies",
|
|
"Spike in File Writes",
|
|
"Prohibited Network Traffic Allowed",
|
|
"SMB Traffic Spike",
|
|
"Common Ransomware Extensions",
|
|
"Common Ransomware Notes",
|
|
"System Processes Run From Unexpected Locations",
|
|
"Remote Process Instantiation via WMI",
|
|
"TOR Traffic",
|
|
"Registry Keys Used For Persistence",
|
|
"Unusually Long Command Line",
|
|
"Scheduled tasks used in BadRabbit ransomware",
|
|
"Schtasks used for forcing a reboot"
|
|
],
|
|
"investigative_searches": [
|
|
"Get Process Info",
|
|
"Get Process Information For Port Activity",
|
|
"Investigate Web Activity From Host",
|
|
"Get Parent Process Info"
|
|
],
|
|
"support_searches": [
|
|
"Monitor Successful Backups",
|
|
"Monitor Unsuccessful Backups",
|
|
"Windows Updates Install Failures",
|
|
"Windows Updates Install Successes"
|
|
]
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|