Detecting BlackMatter ransomware

This search is designed to detect a suspicious registry modification that implements auto admin logon to a host. This technique is seen in BlackMatter ransomware to automatically log on to the compromised host, after a safe mode boot has been triggered, and then encrypt the whole network.

Auto admin logon is not a common practice and should be treated as suspicious.

| tstats summariesonly=false allow_old_summaries=true count FROM datamodel=Endpoint.Registry WHERE ("Registry.registry_path"="*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" ("Registry.registry_value_name"=DefaultPassword OR "Registry.registry_value_name"=DefaultUserName)) BY _time span=1h, "Registry.dest", "Registry.user", "Registry.registry_path", "Registry.registry_value_name", "Registry.process_guid", "Registry.registry_value_data", "Registry.registry_key_name" 
| rename "Registry.*" AS "*" 
| rename process_guid AS proc_guid 
| join _time,proc_guid [ 
   | tstats summariesonly=false allow_old_summaries=true count FROM datamodel=Endpoint.Processes BY _time span=1h, "Processes.process_id", "Processes.process_name", "Processes.process", "Processes.dest", "Processes.parent_process_name", "Processes.parent_process", "Processes.process_guid" 
   | rename "Processes.*" AS "*" 
   | rename process_guid AS proc_guid 
   | fields + _time, dest, user, parent_process_name, parent_process, process_name, process_path, process, proc_guid, registry_path, registry_value_name, registry_value_data, registry_key_name] 
| table _time, dest, user, parent_process_name, parent_process, process_name, process_path, process, proc_guid, registry_path, registry_value_name, registry_value_data, registry_key_name
| search

This search is designed to detect a suspicious bcdedit command line, which is used to configure a host from safe mode back to a normal boot configuration. This technique is seen in BlackMatter ransomware, which forces a compromised host to boot in safe mode to perform encryption, and then brings it back to normal boot settings using the bcdedit deletevalue command.

| tstats summariesonly=false allow_old_summaries=true count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"=bcdedit.exe "Processes.process"="*/deletevalue*" "Processes.process"="*{current}*" "Processes.process"="*safeboot*") BY "Processes.process_name", "Processes.process", "Processes.parent_process_name", "Processes.dest", "Processes.user" 
| rename "Processes.*" AS "*" 
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(firstTime) 
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(lastTime)

This search is designed to detect a suspicious bcdedit command line, used to configure the host to boot in safe mode with network config. This technique is seen in BlackMatter ransomware, which forces a compromised host to boot in safe mode to perform encryption and then brings it back to normal boot settings using bcdedit deletevalue command.

| tstats summariesonly=false allow_old_summaries=true count, min(_time) AS firstTime, max(_time) AS lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"=bcdedit.exe "Processes.process"="*/set*" "Processes.process"="*{current}*" "Processes.process"="*safeboot*" "Processes.process"="*network*") BY "Processes.process_name", "Processes.process", "Processes.parent_process_name", "Processes.dest", "Processes.user" 
| rename "Processes.*" AS "*" 
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(firstTime) 
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(lastTime)

This search detects terminations of services that are commonly stopped by ransomware before files in a compromised machine are encrypted. This technique is commonly used by ransomware to avoid exception errors while accessing targeted files because of the open handle of those services to the targeted file.

False positives from this search may occur since legitimate admin activities or the installation of updates can involve the stopping of these services.

| search (EventCode=7036 Message="*service entered the stopped state*" eventtype=wineventlog_system (Message="*VSS*" OR Message="*Volume Shadow Copy*" OR Message="*backup*" OR Message="*memtas*" OR Message="*mepocs*" OR Message="*sophos*" OR Message="*sql*" OR Message="*svc$*" OR Message="*veeam*")) 
| stats count min(_time) AS firstTime max(_time) AS lastTime BY EventCode Message dest Type 
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(lastTime) 
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(firstTime)

This search identifies suspicious modification of the registry to change the wallpaper of a compromised machine. This technique is commonly seen in ransomware, where a bitmap file is created that contains a note that the machine has been compromised. Then, that image is set as a wallpaper.

False positives from this search may occur since legitimate third party tools can be used to change wallpapers.

| search (EventCode=13 ((Image!="*\\explorer.exe" TargetObject="*\\Control Panel\\Desktop\\Wallpaper") OR (Details="*\\temp\\*" TargetObject="*\\Control Panel\\Desktop\\Wallpaper")) (source=Syslog:Linux-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational)) 
| stats count min(_time) AS firstTime max(_time) AS lastTime BY EventCode Image TargetObject Details Computer process_guid process_id user_id 
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(firstTime) 
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(lastTime)

This search looks for instances where a large number of ransomware notes are files created in the infected machine. These notes often have file extensions of .txt, .html, or .hta.

| search (EventCode=11 (source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational) (file_name="*\.hta" OR file_name="*\.html" OR file_name="*\.txt"))
| stats min(_time) AS firstTime max(_time) AS lastTime dc(TargetFilename) AS unique_readme_path_count values(TargetFilename) AS list_of_readme_path BY Computer Image file_name
| where (unique_readme_path_count >= 50)
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(firstTime)
| convert timeformat="%Y-%m-%dT%H:%M:%S" ctime(lastTime)