Darkside Ransomware

[patel-bhavin]

New Detections

• Delete ShadowCopy With PowerShell (Experimental)
• Extract SAM from Registry (Passed)
• SLUI RunAs Elevated (Passed)
• SLUI Spawning a Process (Passed)
• Detect Renamed RClone (Passed)
• Detect RClone Command-Line Usage (Passed)
• CMLUA Or CMSTPLUA UAC Bypass (Passed)

New Analytic Story

• DarkSide Ransomware

Updated Detections

• Ransomware Notes bulk creation
• Cobalt Strike Named Pipes

[request-info]

We would appreciate it if you could provide us with more info about this issue/pr!

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Delete ShadowCopy With PowerShell ❌

• diskUsage: 159744
• runDuration: 0.869s
• scanCount: 0

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Delete ShadowCopy With PowerShell ❌

• diskUsage: 159744
• runDuration: 0.789s
• scanCount: 275

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

CMLUA Or CMSTPLUA UAC Bypass ✅

• diskUsage: 299008
• runDuration: 0.8240000000000001s
• scanCount: 3

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Detect Renamed RClone ✅

• diskUsage: 143360
• runDuration: 0.856s
• scanCount: 61

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Extract SAM from Registry ✅

• diskUsage: 417792
• runDuration: 5.305s
• scanCount: 6748

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

SLUI RunAs Elevated ❌

• diskUsage: 495616
• runDuration: 1.415s
• scanCount: 2

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

SLUI Spawning a Process ❌

• diskUsage: 94208
• runDuration: 0.003s
• scanCount: 0

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

SLUI Spawning a Process ✅

• diskUsage: 409600
• runDuration: 8.276s
• scanCount: 13801

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

SLUI RunAs Elevated ✅

• diskUsage: 499712
• runDuration: 1.5190000000000001s
• scanCount: 4

[P4T12ICK]

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Delete ShadowCopy With PowerShell ❌

• diskUsage: 163840
• runDuration: 1.184s
• scanCount: 275