[New] Ransomware over SMB #3638
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Samirbous
added
Rule: New
|
no chance for a mitigation in defend on this? |
@CyberTaoFlow we are adding similar rules on the endpoint (Elastic Defend), we can't kill pid 4 (kernel is not a real process) but as a mitigation one can use the resulting alert to isolate the host via automation. |
Samirbous
requested review from
Aegrah,
terrancedejesus,
w0rk3r and
DefSecSentinel
terrancedejesus
approved these changes
May 3, 2024
There was a problem hiding this comment.
Very nice! Thanks for taking the time to add some additional investigation guides. I think that context will be important for these rules and the analyst. I'd be curious if we have any better packet inspection on the SMB forefront with NPC integration? Left a suggestion about setup.
Aegrah
approved these changes
May 6, 2024
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
protectionsmachine
pushed a commit
that referenced
this pull request
May 7, 2024
* [New] Ransomware over SMB * Update impact_ransomware_note_file_over_smb.toml * Update impact_ransomware_file_rename_smb.toml * ++ * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_high_freq_file_renames_by_kernel.toml * Update impact_ransomware_file_rename_smb.toml * Update impact_ransomware_note_file_over_smb.toml * Update impact_high_freq_file_renames_by_kernel.toml (cherry picked from commit 4a2e276)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Identifies file rename or file names like ransom note dropped via SMB.
https://news.sophos.com/en-us/2023/12/21/akira-again-the-ransomware-that-keeps-on-taking/
Threshold based rule (detecs readme files dropped by ransomware) :