Dev-0530 File Extension Rename

Back


Id	d82eb796-d1eb-43c8-a813-325ce3417cef
Rulename	Dev-0530 File Extension Rename
Description	Dev-0530 actors are known to encrypt the contents of the victims device as well as renaming the file extensions. This query looks for the creation of files with .h0lyenc extension or presence of ransom note.
Severity	High
Tactics	Impact
Techniques	T1486
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/Dev-0530_FileExtRename.yaml
Version	1.1.1
Arm template	d82eb796-d1eb-43c8-a813-325ce3417cef.json

KQL

union isfuzzy=true
    (DeviceFileEvents
    | where ActionType == "FileCreated"
    | where FileName endswith ".h0lyenc" or FolderPath == "C:\\FOR_DECRYPT.html"
    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
        by
        AccountName = InitiatingProcessAccountName, AccountDomain = InitiatingProcessAccountDomain,
        DeviceName,
        Type,
        InitiatingProcessId,
        FileName,
        FolderPath,
        EventType = ActionType,
        Commandline = InitiatingProcessCommandLine,
        InitiatingProcessFileName,
        InitiatingProcessSHA256,
        FileHashCustomEntity = SHA256,
        AlgorithmCustomEntity = "SHA256"
    | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
    | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)
    ),
    (imFileEvent
    | where EventType == "FileCreated"
    | where TargetFilePath endswith ".h0lyenc" or TargetFilePath == "C:\\FOR_DECRYPT.html"
    | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
        by
        ActorUsername,
        DvcHostname,
        DvcDomain,
        DvcId,
        Type,
        EventType,
        FileHashCustomEntity = TargetFileSHA256,
        Hash,
        TargetFilePath,
        Commandline = ActingProcessCommandLine,
        AlgorithmCustomEntity = "SHA256"
    | extend AccountName = tostring(split(ActorUsername, @'\')[1]), AccountDomain = tostring(split(ActorUsername, @'\')[0])
    | extend HostName = DvcHostname, HostNameDomain = DvcDomain
    | extend DeviceName = strcat(DvcHostname, ".", DvcDomain )
    )

YAML

version: 1.1.1
queryPeriod: 1d
tags:
- Dev-0530
- Schema: ASIMFileEvent
  SchemaVersion: 0.1.0
relevantTechniques:
- T1486
description: |
    'Dev-0530 actors are known to encrypt the contents of the victims device as well as renaming the file extensions. This query looks for the creation of files with .h0lyenc extension or presence of ransom note.'
kind: Scheduled
name: Dev-0530 File Extension Rename
queryFrequency: 1d
metadata:
  source:
    kind: Community
  categories:
    domains:
    - Security - Others
  support:
    tier: Community
  author:
    name: Microsoft Security Research
id: d82eb796-d1eb-43c8-a813-325ce3417cef
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Impact
triggerThreshold: 0
severity: High
query: |
  union isfuzzy=true
      (DeviceFileEvents
      | where ActionType == "FileCreated"
      | where FileName endswith ".h0lyenc" or FolderPath == "C:\\FOR_DECRYPT.html"
      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
          by
          AccountName = InitiatingProcessAccountName, AccountDomain = InitiatingProcessAccountDomain,
          DeviceName,
          Type,
          InitiatingProcessId,
          FileName,
          FolderPath,
          EventType = ActionType,
          Commandline = InitiatingProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessSHA256,
          FileHashCustomEntity = SHA256,
          AlgorithmCustomEntity = "SHA256"
      | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.'))
      | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)
      ),
      (imFileEvent
      | where EventType == "FileCreated"
      | where TargetFilePath endswith ".h0lyenc" or TargetFilePath == "C:\\FOR_DECRYPT.html"
      | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated)
          by
          ActorUsername,
          DvcHostname,
          DvcDomain,
          DvcId,
          Type,
          EventType,
          FileHashCustomEntity = TargetFileSHA256,
          Hash,
          TargetFilePath,
          Commandline = ActingProcessCommandLine,
          AlgorithmCustomEntity = "SHA256"
      | extend AccountName = tostring(split(ActorUsername, @'\')[1]), AccountDomain = tostring(split(ActorUsername, @'\')[0])
      | extend HostName = DvcHostname, HostNameDomain = DvcDomain
      | extend DeviceName = strcat(DvcHostname, ".", DvcDomain )
      )  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ActorUserName
    identifier: FullName
  - columnName: AccountName
    identifier: Name
  - columnName: AccountDomain
    identifier: NTDomain
- entityType: Host
  fieldMappings:
  - columnName: DeviceName
    identifier: FullName
  - columnName: HostName
    identifier: HostName
  - columnName: HostNameDomain
    identifier: DnsDomain
- entityType: FileHash
  fieldMappings:
  - columnName: AlgorithmCustomEntity
    identifier: Algorithm
  - columnName: FileHashCustomEntity
    identifier: Value
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/Dev-0530_FileExtRename.yaml
triggerOperator: gt

ARM