Skip to content
This repository was archived by the owner on Nov 16, 2023. It is now read-only.

Commit bed1cfd

Browse files
tali-ashtali-ash
authored
Merge pull request #231 from martyav/ransomware-healthcare-misc
added misc pages related to ransomware techniques
2 parents eff4071 + 16a8217 commit bed1cfd

5 files changed

Lines changed: 271 additions & 0 deletions

File tree

‎Defense evasion/alt-data-streams.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Detect use of Alternate Data Streams
2+
3+
This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/).
4+
5+
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
6+
7+
The following query detects suspicious use of [Alternate Data Streams](https://docs.microsoft.com/sysinternals/downloads/streams) (ADS), which may indicate an attempt to mask malicious activity. These campaigns have been known to deploy ransomware in-memory and exploit ADS.
8+
9+
The [See also](#see=also) section below lists more queries related to techniques shared by these campaigns.
10+
11+
## Query
12+
13+
```Kusto
14+
// Alternate Data Streams execution
15+
DeviceProcessEvents
16+
| where Timestamp > ago(7d)
17+
// Command lines used
18+
| where ProcessCommandLine startswith "-q -s" and ProcessCommandLine hasprefix "-p"
19+
// Removing IDE processes
20+
and not(FolderPath has_any("visual studio", "ide"))
21+
| summarize make_set(ProcessCommandLine), make_set(FolderPath),
22+
make_set(InitiatingProcessCommandLine) by DeviceId, bin(Timestamp, 1h)
23+
```
24+
25+
## Category
26+
27+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
28+
29+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
30+
|-|-|-|
31+
| Initial access | | |
32+
| Execution | | |
33+
| Persistence | | |
34+
| Privilege escalation | | |
35+
| Defense evasion | v | |
36+
| Credential Access | | |
37+
| Discovery | | |
38+
| Lateral movement | | |
39+
| Collection | | |
40+
| Command and control | | |
41+
| Exfiltration | | |
42+
| Impact | | |
43+
| Vulnerability | | |
44+
| Misconfiguration | | |
45+
| Malware, component | | |
46+
47+
## See also
48+
49+
[Return backup files deletion events](../Impact/backup-deletion.md)
50+
[Detect attempts to turn off System Restore](./turn-off-system-restore.md)
51+
[Detect cipher.exe deleting data](./deleting-data-w-cipher-tool.md)
52+
[Detect clearing of system logs](./clear-system-logs.md)
53+
54+
## Contributor info
55+
56+
**Contributor:** Microsoft Threat Protection team

‎Defense evasion/clear-system-logs.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Detect clearing of system logs
2+
3+
This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/).
4+
5+
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
6+
7+
The following query detects attempts to use *fsutil.exe* to clear system logs and delete forensic artifacts.
8+
9+
The [See also](#see=also) section below lists more queries related to techniques shared by these campaigns.
10+
11+
## Query
12+
13+
```Kusto
14+
DeviceProcessEvents
15+
| where Timestamp > ago(7d)
16+
| where FileName =~ "fsutil.exe"
17+
and ProcessCommandLine has "usn" and ProcessCommandLine has "deletejournal"
18+
```
19+
20+
## Category
21+
22+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
23+
24+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
25+
|-|-|-|
26+
| Initial access | | |
27+
| Execution | | |
28+
| Persistence | | |
29+
| Privilege escalation | | |
30+
| Defense evasion | v | |
31+
| Credential Access | | |
32+
| Discovery | | |
33+
| Lateral movement | | |
34+
| Collection | | |
35+
| Command and control | | |
36+
| Exfiltration | | |
37+
| Impact | | |
38+
| Vulnerability | | |
39+
| Misconfiguration | | |
40+
| Malware, component | | |
41+
42+
## See also
43+
44+
[Return backup files deletion events](../Impact/backup-deletion.md)
45+
[Detect use of Alternate Data Streams](./alt-data-streams.md)
46+
[Detect attempts to turn off System Restore](./turn-off-system-restore.md)
47+
[Detect cipher.exe deleting data](./deleting-data-w-cipher-tool.md)
48+
49+
## Contributor info
50+
51+
**Contributor:** Microsoft Threat Protection team

‎Defense evasion/deleting-data-w-cipher-tool.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Detect cipher.exe deleting data
2+
3+
This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/).
4+
5+
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
6+
7+
The following query detects the use of the tool *cipher.exe* to delete indicators of malicious activity right before encrypting a drive.
8+
9+
The [See also](#see=also) section below lists more queries related to techniques shared by these campaigns.
10+
11+
## Query
12+
13+
```Kusto
14+
​DeviceProcessEvents
15+
| where Timestamp > ago(7d)
16+
| where FileName =~ "cipher.exe"
17+
// Looking for /w flag for deleting
18+
| where ProcessCommandLine has "/w"
19+
| summarize CommandCount = dcount(ProcessCommandLine),
20+
make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 1m)
21+
// Looking for multiple drives in a short timeframe
22+
| where CommandCount > 1
23+
```
24+
25+
## Category
26+
27+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
28+
29+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
30+
|-|-|-|
31+
| Initial access | | |
32+
| Execution | | |
33+
| Persistence | | |
34+
| Privilege escalation | | |
35+
| Defense evasion | v | |
36+
| Credential Access | | |
37+
| Discovery | | |
38+
| Lateral movement | | |
39+
| Collection | | |
40+
| Command and control | | |
41+
| Exfiltration | | |
42+
| Impact | | |
43+
| Vulnerability | | |
44+
| Misconfiguration | | |
45+
| Malware, component | | |
46+
47+
## See also
48+
49+
[Return backup files deletion events](../Impact/backup-deletion.md)
50+
[Detect use of Alternate Data Streams](./alt-data-streams.md)
51+
[Detect attempts to turn off System Restore](./turn-off-system-restore.md)
52+
[Detect clearing of system logs](./clear-system-logs.md)
53+
54+
## Contributor info
55+
56+
**Contributor:** Microsoft Threat Protection team

‎Impact/backup-deletion.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Return backup files deletion events
2+
3+
This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/).
4+
5+
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
6+
7+
The following query returns alerts raised when backup files were deleted.
8+
9+
The [See also](#see=also) section below lists more queries related to techniques shared by these campaigns.
10+
11+
## Query
12+
13+
```Kusto
14+
AlertInfo
15+
| where Timestamp > ago(7d)
16+
| where Title == "File backups were deleted"
17+
```
18+
19+
## Category
20+
21+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
22+
23+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
24+
|-|-|-|
25+
| Initial access | | |
26+
| Execution | | |
27+
| Persistence | | |
28+
| Privilege escalation | | |
29+
| Defense evasion | v | |
30+
| Credential Access | | |
31+
| Discovery | | |
32+
| Lateral movement | | |
33+
| Collection | | |
34+
| Command and control | | |
35+
| Exfiltration | | |
36+
| Impact | v | |
37+
| Vulnerability | | |
38+
| Misconfiguration | | |
39+
| Malware, component | | |
40+
41+
## See also
42+
43+
[Detect use of Alternate Data Streams](../Defense%20evasion/alt-data-streams.md)
44+
[Detect attempts to turn off System Restore](../Defense%20evasion/turn-off-system-restore.md)
45+
[Detect cipher.exe deleting data](../Defense%20evasion/deleting-data-w-cipher-tool.md)
46+
[Detect clearing of system logs](../Defense%20evasion/clear-system-logs.md)
47+
48+
## Contributor info
49+
50+
**Contributor:** Microsoft Threat Protection team

‎Impact/turn-off-system-restore.md‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# Detect attempts to turn off System Restore
2+
3+
This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/).
4+
5+
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
6+
7+
The following query detects attempts to stop System Restore, which would prevent the user from recovering data by going back to a restore point.
8+
9+
The [See also](#see=also) section below lists more queries related to techniques shared by these campaigns.
10+
11+
## Query
12+
13+
```Kusto
14+
​DeviceProcessEvents
15+
| where Timestamp > ago(7d)
16+
//Pivoting for rundll32
17+
and InitiatingProcessFileName =~ 'rundll32.exe'
18+
//Looking for empty command line
19+
and InitiatingProcessCommandLine !contains " " and InitiatingProcessCommandLine != ""
20+
//Looking for schtasks.exe as the created process
21+
and FileName in~ ('schtasks.exe')
22+
//Disabling system restore
23+
and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore'
24+
and ProcessCommandLine has 'disable'
25+
```
26+
27+
## Category
28+
29+
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
30+
31+
| Technique, tactic, or state | Covered? (v=yes) | Notes |
32+
|-|-|-|
33+
| Initial access | | |
34+
| Execution | | |
35+
| Persistence | | |
36+
| Privilege escalation | | |
37+
| Defense evasion | v | |
38+
| Credential Access | | |
39+
| Discovery | | |
40+
| Lateral movement | | |
41+
| Collection | | |
42+
| Command and control | | |
43+
| Exfiltration | | |
44+
| Impact | v | |
45+
| Vulnerability | | |
46+
| Misconfiguration | | |
47+
| Malware, component | | |
48+
49+
## See also
50+
51+
[Return backup files deletion events](./backup-deletion.md)
52+
[Detect use of Alternate Data Streams](../Defense%20evasion/alt-data-streams.md)
53+
[Detect cipher.exe deleting data](../Defense%20evasion/deleting-data-w-cipher-tool.md)
54+
[Detect clearing of system logs](../Defense%20evasion/clear-system-logs.md)
55+
56+
## Contributor info
57+
58+
**Contributor:** Microsoft Threat Protection team

0 commit comments

Comments
 (0)