mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
49 lines
2.2 KiB
YAML
49 lines
2.2 KiB
YAML
name: Common Ransomware Extensions
|
|
id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
|
|
version: 3
|
|
date: '2020-03-16'
|
|
description: The search looks for file modifications with extensions commonly used
|
|
by Ransomware
|
|
how_to_implement: 'You must be ingesting data that records the filesystem activity
|
|
from your hosts to populate the Endpoint file-system data model node. If you are
|
|
using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
|
|
you want to collect data.\
|
|
|
|
This search produces fields (`query`,`query_length`,`count`) that are not yet supported
|
|
by ES Incident Review and therefore cannot be viewed when a notable event is raised.
|
|
These fields contribute additional context to the notable. To see the additional
|
|
metadata, add the following fields, if not already present, to Incident Review -
|
|
Event Attributes (Configure > Incident Management > Incident Review Settings > Add
|
|
New Entry):\\n1. **Label:** Name, **Field:** Name\
|
|
|
|
1. \
|
|
|
|
1. **Label:** File Extension, **Field:** file_extension\
|
|
|
|
Detailed documentation on how to create a new field within Incident Review may be
|
|
found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
|
|
type: ESCU
|
|
references: []
|
|
author: David Dorsey, Splunk
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
|
|
as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
|
|
| `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex
|
|
field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`'
|
|
known_false_positives: It is possible for a legitimate file with these extensions
|
|
to be created. If this is a true ransomware attack, there will be a large number
|
|
of files created with these extensions.
|
|
tags:
|
|
analytics_story:
|
|
- SamSam Ransomware
|
|
- Ransomware
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
cis20:
|
|
- CIS 8
|
|
nist:
|
|
- PR.PT
|
|
- DE.CM
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|