splunk-security_content/docs/_posts/2021-06-02-revil_common_exec_parameter.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Revil Common Exec Parameter	User Execution	Endpoint	2021-06-02	true		TTP T1204 User Execution Execution Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint Exploitation

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-06-02
• Author: Teoderick Contreras, Splunk
• ID: 85facebe-c382-11eb-9c3e-acde48001122

ATT&CK

ID	Technique	Tactic
T1204	User Execution	Execution

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "* -nolan *" OR Processes.process = "* -nolocal *" OR Processes.process = "* -fast *" OR Processes.process = "* -full *" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `revil_common_exec_parameter_filter`

Associated Analytic Story

• Ransomware
• Revil Ransomware

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

• _time
• Processes.process_name
• Processes.process
• Processes.parent_process_name
• Processes.parent_process
• Processes.dest
• Processes.user
• Processes.process_id
• Processes.process_guid

Kill Chain Phase

• Exploitation

Known False Positives

third party tool may have same command line parameters as revil ransomware.

RBA

Risk Score	Impact	Confidence	Message
54.0	60	90	A process process_name with commandline process related to revil ransomware in host dest

Reference

• https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
• https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-sysmon.log

source | version: 2