OVERVIEW
The cyberworld is constantly threatened by malicious ransomware, hence it’s becoming more trendy, recent attacks like the colonial pipeline proves that it’s just the beginning of an era of ransomware war as attackers take advantage of cloud delivery models like Software as a service (SaaS) Platform-as-a-Service (PaaS) to run ransomware as a service and targeting the organization.
The ransomware attacks around the globe have gone up by 102 percent in 2021 compared to 2020. Further, the statistics reveal that India is the most impacted country with 213 weekly ransomware attacks per organization which is 17 percent up from the beginning of the year.
Ransomware Hunting
Hunting ransomware needs a more proactive and reactive approach to detect and defend it, many researchers keep on analyzing the root cause for the ransomware, but attackers easily trick to disable the antivirus without attracting the attention of incident responders or security operations centers (SOCs).
Ransomware attacks often involved in an activity such us
- EDR & AV evasion
- Encrypting the entire disc
- Deleting backups
- Clearing forensic evidence
- Demand huge ransome
Indication of Ransomware Activity
The below listed are the common artifacts that have been observed in many ransomware.
STOP PROCESS
Tool: taskkill.exe, net stop
Taskkill.exe: windows internal service used to end one or more task or processes
Net stop: An command line utility used to stop a network service
The stop process used by attackers to ensure files targeted for encryption are not locked or detected by various applications
Stopping multiple processes using taskkill.exe
// Find attempts to stop processes using taskkill.exe
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ “taskkill.exe”
| summarize taskKillCount = dcount(ProcessCommandLine), TaskKillList = make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 2m)
| where taskKillCount > 10
Stopping multiple processes using Netstop
// Find attempts to stop processes using net stop
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ “net.exe” and ProcessCommandLine has “stop”
| summarize netStopCount = dcount(ProcessCommandLine), NetStopList = make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 2m)
| where netStopCount > 10
Also Read: Latest Ransomware CVEs – Vulnerabilities Abused by Ransomware Actors
Turn OFF Service
Tool: sc.exe
SC.exe: An command-line utility used to Create, Start, Stop, Query, or Delete any Windows SERVICE.
The Turn off services is used by attackers to evade locks by various applications and prevent security software from disrupting encryption and other ransomware activity.
Turning service on/off using sc.exe
// Look for sc.exe disabling services
DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has “sc” and ProcessCommandLine has “config” and ProcessCommandLine has “disabled”
| summarize ScDisableCount = dcount(ProcessCommandLine), ScDisableList = make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 5m)
| where ScDisableCount > 10
Delete Logs and Files
Tools: cipher.exe, wevtutil, fsutil.exe
Cipher.exe: Command-line utility to wipe data permanently.
wevtutil: An command-line utility used to retrieve information about event logs and used to install and uninstall event manifests.
Fsutil.exe: An command-line utility used to perform task-related file allocation table (FAT) and NTFS file system and used to managing sparse files, or dismounting a volume.
Deleted log and files are used by attacks to evade from forensics analysing and remove forensic evidence
Deletion of data on multiple drives using Cipher.exe
// Look for cipher.exe deleting data from multiple drives
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ “cipher.exe”
// cipher.exe /w flag used for deleting data
| where ProcessCommandLine has “/w”
| summarize CipherCount = dcount(ProcessCommandLine),
CipherList = make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 1m)
// cipher.exe accessing multiple drives in a short timeframe
| where CipherCount > 1
Clearing forensics traces from event logs using Wevtutil
// Look for use of wevtutil to clear multiple logs
DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has “WEVTUTIL” and ProcessCommandLine has “CL”
| summarize LogClearCount = dcount(ProcessCommandLine), ClearedLogList = make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 5m)
| where LogClearCount > 10
Delete Shadow Copy
Shadow copy is a technology used to create backup copies or snapshots of computer files or volumes,
Tools: vsadmin.exe, wmic.exe
Vsadmin.exe: An command-line utility used to manage the Shadow Volume Copies.
Wmic.exe: An command-line utility to perform Windows Management Instrumentation (WMI) operations
Attackers are used to Destroying drive shadow copies that can be used to recover encrypted files.
Also Read: Latest IOCs – Threat Actor URLs , IP’s & Malware Hashes
Delete & Stop Backup
Tool: wbadmin.exe
Wbadmin.exe: An command line utility used to create/delete operating system backup.
Attacker used to deleted existing backups to preventing recovery after encryption.
Removing/deleting backups
DeviceProcessEvents
| where FileName =~ “wmic.exe”
| where ProcessCommandLine has “shadowcopy” and ProcessCommandLine has “delete”
| project DeviceId, Timestamp, InitiatingProcessFileName, FileName,
ProcessCommandLine, InitiatingProcessIntegrityLevel, InitiatingProcessParentFileName
Modify Boot settings
Tool: bcdedit.exe
Bcdedit.exe: Primary tool for modifying or configuring boot settings
Attackers use modify boot settings to turn off warnings and automatic repairs after boot failures
Turn off recovery tools
Tools: schtasks.exe, regedit.exe
Schtasks.exe: An command-line utility to create, delete, query, change, run, and end scheduled tasks on a local or remote computer
Regedit.exe: An command-line utility used to view and edit keys and entries in the Windows registry database
The attacker used to turn off System Restore and other system recovery options.
Turning off system restore
DeviceProcessEvents
//Pivoting for rundll32
| where InitiatingProcessFileName =~ ‘rundll32.exe’
//Looking for empty command line
and InitiatingProcessCommandLine !contains ” ” and InitiatingProcessCommandLine != “”
//Looking for schtasks.exe as the created process
and FileName in~ (‘schtasks.exe’)
//Disabling system restore
and ProcessCommandLine has ‘Change’ and ProcessCommandLine has ‘SystemRestore’
and ProcessCommandLine has ‘disable
Also Read: Free Automated Malware Analysis Sandboxes for Incident Response
Conclusion
The above mentioned are some commonly observed artifacts used by attackers to encrypt, prevent detection, and clear forensic evidence. Hence it clearly states that the prevention of ransomware attacks needs both a proactive and reactive approach, the above-mentioned indication or sign helps you to create queries that locate individual artifacts associated with ransomware activity.
Reference:
- https://github.com/MicrosoftDocs/microsoft-365-docs/blob/public/microsoft-365/security/defender/advanced-hunting-find-ransomware.md
- https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
- https://www.proofpoint.com/us/threat-reference/ransomware