Ryuk story and detections

bin/generate.py

@@ -279,10 +279,8 @@ def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PAT
                 template = j2_env.get_template('panel.j2')
                 file_path = "default/data/ui/panels/workbench_panel_" + response_file_name + ".xml"
                 output_path = path.join(OUTPUT_PATH, file_path)
-                if response_task['search'].find(">") is not -1:
-                    response_task['search']= response_task['search'].replace(">",">")
-                if response_task['search'].find("<") is not -1:
-                    response_task['search']= response_task['search'].replace("<","&lt;")
+                response_task['search']= response_task['search'].replace(">","&gt;")
+                response_task['search']= response_task['search'].replace("<","&lt;")
 
                 output = template.render(search=response_task['search'])
                 with open(output_path, 'w') as f:

bin/validate.py

@@ -62,7 +62,7 @@ def validate_schema(REPO_PATH, type, objects):
     return objects, error, errors
 
 
-def validate_objects(REPO_PATH, objects):
+def validate_objects(REPO_PATH, objects, verbose):
 
     # uuids
     uuids = []
@@ -76,6 +76,8 @@ def validate_objects(REPO_PATH, objects):
         validation_errors, uuids = validate_standard_fields(object, uuids)
         errors = errors + validation_errors
 
+    if verbose:
+        print("validating object {0}".format(object['name']))
     for object in objects['detections']:
         if object['type'] == 'ESCU':
             errors = errors + validate_detection_search(object, objects['macros'])
@@ -159,6 +161,11 @@ def validate_detection_search(object, macros):
         errors.append("ERROR: Missing filter for detection: " + object['name'])
 
     filter_macro = re.search("([a-z0-9_]*_filter)", object['search'])
+
+    if not filter_macro:
+        errors.append("ERROR: filter macro not found for detection: " + object['name'])
+        return errors
+
     if filter_macro.group(1) != (object['name'].replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter'):
         errors.append("ERROR: filter for detection: " + object['name'] + " needs to use the name of the detection in lowercase and the special characters needs to be converted into _ .")
 
@@ -242,7 +249,7 @@ def validate_lookups_content(REPO_PATH, lookup_path, lookup):
         if len(errors) > 0:
             schema_errors = schema_errors + errors
 
-    validation_errors = validate_objects(REPO_PATH, objects)
+    validation_errors = validate_objects(REPO_PATH, objects, verbose)
 
     schema_errors = schema_errors + validation_errors
 

detections/endpoint/common_ransomware_extensions.yml

@@ -36,6 +36,7 @@ known_false_positives: It is possible for a legitimate file with these extension
 tags:
   analytics_story:
   - SamSam Ransomware
+  - Ryuk Ransonware
   - Ransomware
   mitre_attack_id:
   - T1485

detections/endpoint/common_ransomware_notes.yml

@@ -23,6 +23,7 @@ tags:
   analytics_story:
   - SamSam Ransomware
   - Ransomware
+  - Ryuk Ransomware
   mitre_attack_id:
   - T1485
   kill_chain_phases:

detections/endpoint/ryuk_test_files_detected.yml

@@ -0,0 +1,32 @@
+name: Ryuk Test Files Detected
+id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3
+version: 1
+date: '2020-11-06'
+description: 'The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation.' 
+how_to_implement: 'You must be ingesting data that records the filesystem activity
+  from your hosts to populate the Endpoint Filesystem data-model object. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.'
+type: ESCU
+references: []
+author: Rod Soto, Jose Hernandez, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path"
+  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `ryuk_test_files_detected_filter`'
+known_false_positives: If there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential FPs.
+tags:
+  mitre_attack_id:
+    - T1486
+  analytics_story:
+  - Ryuk Ransomware
+  kill_chain_phases:
+  - Delivery
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/samsam_test_file_write.yml

@@ -1,5 +1,5 @@
 name: Samsam Test File Write
-id: 69c12d59-d951-431e-ab77-ec426b8d65e6
+id: 493a879d-519d-428f-8f57-a06a0fdc107e
 version: 1
 date: '2018-12-14'
 description: The search looks for a file named "test.txt" written to the windows system

detections/endpoint/spike_in_file_writes.yml

@@ -25,6 +25,7 @@ known_false_positives: It is important to understand that if you happen to insta
 tags:
   analytics_story:
   - SamSam Ransomware
+  - Ryuk Ransomware
   - Ransomware
   kill_chain_phases:
   - Actions on Objectives

detections/endpoint/windows_connhost_exe_force_flag.yml

@@ -0,0 +1,31 @@
+name: Windows connhost exe started forcefully
+id: c114aaca-68ee-41c2-ad8c-32bf21db8769
+version: 1
+date: '2020-11-06'
+description: 'The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. 
+This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware.'
+how_to_implement: You must be ingesting data that records the process-system activity
+  from your hosts to populate the Endpoint Processes data-model object. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.
+type: ESCU
+references: []
+author: Rod Soto, Jose Hernandez, Splunk
+search: '| `sysmon` CommandLine="*C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1*" EventCode=4688 
+  | table CommandLine, Computer, EventCode, SubjectUserSid
+  | `windows_connhost_exe_started_forcefully_filter`'
+known_false_positives: This process should not be ran forcefully, we have not see any false positives for this detection
+tags:
+  mitre_attack_id:
+    - T1059.003
+  analytics_story:
+    - Ryuk Ransomware
+  kill_chain_phases:
+    - Delivery
+  cis20:
+    - CIS 8
+  nist:
+    - PR.PT
+    - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_disableantispyware_reg.yml

@@ -0,0 +1,36 @@
+name: Windows DisableAntiSpyware Registry
+id: 23150a40-9301-4195-b802-5bb4f43067fb
+version: 1
+date: '2020-11-06'
+description: The search looks for the Registry Key DisableAntiSpyware set to disable. 
+  This is consistent with Ryuk infections across a fleet of endpoints. 
+how_to_implement: You must be ingesting data that records the process-system activity
+  from your hosts to populate the Endpoint Processes data-model object. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.
+type: ESCU
+references: []
+author: Rod Soto, Jose Hernandez, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_key_name="DisableAntiSpyware" AND
+  Registry.registry_value_name="DWORD (0x00000000)" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_disableantispyware_registry_filter`'
+known_false_positives: It is unusual to turn this feature on a Windows system since it is a default security control, although it is not rare for some policies to disable it. 
+  Although no false positives have been identified, use the provided filter macro to tune the search.
+tags:
+  mitre_attack_id:
+    - T1562.001
+  analytics_story:
+  - Ryuk Ransomware
+  kill_chain_phases:
+  - Delivery
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_security_account_manager_stopped.yml

@@ -0,0 +1,34 @@
+name: Windows Security Account Manager Stopped
+id: 69c12d59-d951-431e-ab77-ec426b8d65e6
+version: 1
+date: '2020-11-06'
+description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. 
+  This is consistent with Ryuk infections across a fleet of endpoints. 
+how_to_implement: You must be ingesting data that records the process-system activity
+  from your hosts to populate the Endpoint Processes data-model object. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.
+type: ESCU
+references: []
+author: Rod Soto, Jose Hernandez, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process"
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` 
+  | `windows_security_account_manager_stopped_filter`'
+known_false_positives: SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified.
+tags:
+  mitre_attack_id:
+    - T1489
+  analytics_story:
+  - Ryuk Ransomware
+  kill_chain_phases:
+  - Delivery
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint

detections/network/remote_desktop_network_bruteforce.yml

@@ -21,6 +21,7 @@ known_false_positives: RDP gateways may have unusually high amounts of traffic f
 tags:
   analytics_story:
   - SamSam Ransomware
+  - Ryuk Ransomware
   mitre_attack_id:
   - T1021.001
   kill_chain_phases:

detections/network/remote_desktop_network_traffic.yml

@@ -28,6 +28,7 @@ known_false_positives: Remote Desktop may be used legitimately by users on the n
 tags:
   analytics_story:
   - SamSam Ransomware
+  - Ryuk Ransomware
   - Hidden Cobra Malware
   - Lateral Movement
   mitre_attack_id:

lookups/ransomware_extensions.csv

@@ -288,4 +288,5 @@ Extensions,Name
 .wcry,WannaCry
 .wnry,WannaCry
 .wncryt,WannaCry
-.WNCRYT,WannaCry
+.WNCRYT,WannaCry
+.RYK,Ryuk

lookups/ransomware_notes.csv

@@ -56,4 +56,4 @@ HELP_DECRYPT_YOUR_FILES.HTML,True
 *-HELP_FOR_DECRYPT_FILE.html,True
 *-SORRY-FOR-FILES.html,True
 *-READ-FOR-HELLPP.html,True
-PLEASE_READ_FOR_DECRYPT_FILES_*.html,True
+RyukReadMe.html,True

stories/ransomware_ryuk.yml

@@ -0,0 +1,20 @@
+name: Ryuk Ransomware
+id: 507edc74-13d5-4339-878e-b9744ded1f35
+version: 1
+date: '2020-11-06'
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the Ryuk ransomware, including looking for file writes associated
+  with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more.
+narrative: 'Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. 
+The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot.' 
+author: Jose Hernandez, Splunk
+type: ESCU
+references:
+- https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html
+- https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
+- https://us-cert.cisa.gov/ncas/alerts/aa20-302a
+tags:
+  analytics_story: Ryuk Ransomware
+  usecase: Advanced Threat Detection
+  category:
+  - Malware