Detection: File with Samsam Extension

Updated Date: 2026-01-17 ID: 02c6cfc2-ae66-4735-bfc7-6291da834cbf Author: Rico Valdez, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects file writes with extensions indicative of a SamSam ransomware attack. It leverages file-system activity data to identify file names ending in .stubbin, .berkshire, .satoshi, .sophos, or .keyxml. This activity is significant because SamSam ransomware is highly destructive, leading to file encryption and ransom demands. If confirmed malicious, the impact includes significant financial losses, operational disruptions, and reputational damage. Immediate actions should include isolating affected systems, restoring files from backups, and investigating the attack source to prevent further incidents.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5        values(Filesystem.user) as user
 6        values(Filesystem.dest) as dest
 7        values(Filesystem.file_path) as file_path
 8from datamodel=Endpoint.Filesystem where
 9Filesystem.file_name IN (
10  "*.berkshire",
11  "*.keyxml",
12  "*.satoshi",
13  "*.sophos",
14  "*.stubbin"
15)
16by Filesystem.action Filesystem.dest Filesystem.file_access_time
17   Filesystem.file_create_time Filesystem.file_hash
18   Filesystem.file_modify_time Filesystem.file_name
19   Filesystem.file_path Filesystem.file_acl Filesystem.file_size
20   Filesystem.process_guid Filesystem.process_id
21   Filesystem.user Filesystem.vendor_product
22
23| `drop_dm_object_name(Filesystem)`
24
25| `security_content_ctime(lastTime)`
26
27| `security_content_ctime(firstTime)`
28
29| rex field=file_name "(?<file_extension>\.[^\.]+)$"
30
31| search file_extension IN (".berkshire", ".keyxml", ".satoshi", ".sophos", ".stubbin")
32
33| `file_with_samsam_extension_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
file_with_samsam_extension_filter	`search *`

file_with_samsam_extension_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Risk Event	True

This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

You must be ingesting data that records file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.

Known False Positives

Because these extensions are not typically used in normal operations, you should investigate all results.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

The $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$

Risk Object	Risk Object Type	Risk Score	Threat Objects
dest	system	90	file_name
user	user	90	file_name

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 10