NotPetya Ransomware Activity

testcritical

log source: windows · process_creationauthor Florian Roth (Nextron Systems), Tom Ueltschidate 2019-01-16

description

What this is, in brief.

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

rule source (YAML)

title: NotPetya Ransomware Activity
id: 79aeeb41-8156-4fac-a0cd-076495ab82a1
status: test
description: Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
references:
    - https://securelist.com/schroedingers-petya/78870/
    - https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100
author: Florian Roth (Nextron Systems), Tom Ueltschi
date: 2019-01-16
modified: 2022-12-15
tags:
    - attack.stealth
    - attack.defense-impairment
    - attack.t1218.011
    - attack.t1685.005
    - attack.credential-access
    - attack.t1003.001
    - car.2016-04-002
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_specific_pattern:
        CommandLine|contains:
            - 'wevtutil cl Application & fsutil usn deletejournal /D C:'
            - 'dllhost.dat %WINDIR%\ransoms'
    selection_rundll32:
        Image|endswith: '\rundll32.exe'
        CommandLine|endswith:
            - '.dat,#1'
            - '.dat #1' # Sysmon removes comma
            - '.zip.dll",#1'
    selection_perfc_keyword:
        - '\perfc.dat'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical

detects techniques (3)

ATT&CK techniques this enables or maps to.

references

External citations — patches, advisories, analysis.