mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
pyth0n1c
91 lines
3.2 KiB
YAML
91 lines
3.2 KiB
YAML
name: Common Ransomware Extensions
|
|
id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
|
|
version: 4
|
|
date: '2020-11-09'
|
|
author: David Dorsey, Splunk
|
|
type: Hunting
|
|
datamodel:
|
|
- Endpoint.Filesystem
|
|
description: The search looks for file modifications with extensions commonly used
|
|
by Ransomware
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
|
|
as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
|
|
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex
|
|
field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`'
|
|
how_to_implement: 'You must be ingesting data that records the filesystem activity
|
|
from your hosts to populate the Endpoint file-system data model node. If you are
|
|
using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
|
|
you want to collect data.\
|
|
|
|
This search produces fields (`query`,`query_length`,`count`) that are not yet supported
|
|
by ES Incident Review and therefore cannot be viewed when a notable event is raised.
|
|
These fields contribute additional context to the notable. To see the additional
|
|
metadata, add the following fields, if not already present, to Incident Review -
|
|
Event Attributes (Configure > Incident Management > Incident Review Settings > Add
|
|
New Entry):\\n1. **Label:** Name, **Field:** Name\
|
|
|
|
1. \
|
|
|
|
1. **Label:** File Extension, **Field:** file_extension\
|
|
|
|
Detailed documentation on how to create a new field within Incident Review may be
|
|
found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
|
|
known_false_positives: It is possible for a legitimate file with these extensions
|
|
to be created. If this is a true ransomware attack, there will be a large number
|
|
of files created with these extensions.
|
|
references: []
|
|
tags:
|
|
Consequence: Data Destruction
|
|
analytic_story:
|
|
- SamSam Ransomware
|
|
- Ryuk Ransomware
|
|
- Ransomware
|
|
- Clop Ransomware
|
|
asset_type: Endpoint
|
|
automated_detection_testing: passed
|
|
cis20:
|
|
- CIS 8
|
|
confidence: 100
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Execution
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log
|
|
impact: 90
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$,
|
|
this is indicative of a known ransomware file extension and should be reviewed
|
|
immediately.
|
|
mitre_attack_id:
|
|
- T1485
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: file_name
|
|
type: File Name
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- Endpoint.Filesystem.dest
|
|
- Endpoint.Filesystem.file_name
|
|
- Endpoint.Filesystem.file_path
|
|
- Endpoint.Filesystem.user
|
|
- _time
|
|
risk_score: 90
|
|
security_domain: endpoint
|