File downloaded to a machine from a website

You might need to investigate whether files were downloaded to a machine from a malicious website, even when you don’t know the names of the website or the files. The ability to sort through all files and websites efficiently can be useful when doing the following:

• Investigating a ransomware attack

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Example 

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

A user’s system has been infected with ransomware. You suspect that the source was a file the user downloaded from a suspicious website.

1. Run the following search:

sourcetype=stream:http src=<IP address of infected machine>
|stats count values(url) BY dest

2. Review the results for values that you find suspicious. Research key attributes. Many security firms blog about popular implementations of ransomware or malware.
3. After you have identified a suspicious file type, corroborate your findings using other sourcetypes. For example, if you found the suspicious file mhtr.jpg, you might search:
   

sourcetype=suricata src=<IP address of infected machine> url=<the suspicious URL identified in the previous search>
|stats count values(url) BY dest

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

The results show files that were downloaded to the user’s machine as a result of websites he visited. If you see the suspicious file associated with the same domains across multiple log source types, you can have a fair amount of confidence that it’s the file you want. Research suspicious file names to see if they have been reported elsewhere. When you know more about the file, you can determine the appropriate steps to take.