NotPetya Ransomware Activity

testcritical
Log-Quelle: windows · process_creationAutor Florian Roth (Nextron Systems), Tom UeltschiDatum 2019-01-16
01

Beschreibung

Was dies ist, in Kürze.

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

02

Tags

attack.stealthattack.defense-impairmentattack.t1218.011attack.t1685.005attack.credential-accessattack.t1003.001car.2016-04-002detection.emerging-threats
03

Regelquelle (YAML)

title: NotPetya Ransomware Activity
id: 79aeeb41-8156-4fac-a0cd-076495ab82a1
status: test
description: Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
references:
    - https://securelist.com/schroedingers-petya/78870/
    - https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100
author: Florian Roth (Nextron Systems), Tom Ueltschi
date: 2019-01-16
modified: 2022-12-15
tags:
    - attack.stealth
    - attack.defense-impairment
    - attack.t1218.011
    - attack.t1685.005
    - attack.credential-access
    - attack.t1003.001
    - car.2016-04-002
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_specific_pattern:
        CommandLine|contains:
            - 'wevtutil cl Application & fsutil usn deletejournal /D C:'
            - 'dllhost.dat %WINDIR%\ransoms'
    selection_rundll32:
        Image|endswith: '\rundll32.exe'
        CommandLine|endswith:
            - '.dat,#1'
            - '.dat #1' # Sysmon removes comma
            - '.zip.dll",#1'
    selection_perfc_keyword:
        - '\perfc.dat'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical
04

erkennt Techniken (3)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.