Detection: Common Ransomware Extensions

Updated Date: 2026-07-02 ID: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec Author: David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects modifications to files with extensions commonly associated with ransomware. It leverages the Endpoint.Filesystem data model to identify changes in file extensions that match known ransomware patterns. This activity is significant because it suggests an attacker is attempting to encrypt or alter files, potentially leading to severe data loss and operational disruption. If confirmed malicious, this activity could result in the encryption of critical data, rendering it inaccessible and causing significant damage to the organization's data integrity and availability.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5        latest(Filesystem.user) as user
 6        values(Filesystem.file_path) as file_path
 7FROM datamodel=Endpoint.Filesystem WHERE
 8
 9Filesystem.action IN (
10    "created",
11    "modified"
12)
13NOT Filesystem.file_name IN (
14    "*.7z", "*.aac", "*.appx", "*.appxbundle", "*.asc", "*.asm", "*.avi",
15    "*.bak", "*.bat", "*.bin", "*.bmp", "*.bz2", "*.cab", "*.cer",
16    "*.cfg", "*.cmd", "*.com", "*.conf", "*.cpp", "*.crt", "*.cs",
17    "*.csh", "*.css", "*.csv", "*.cxx", "*.dat", "*.deb", "*.der",
18    "*.diff", "*.dll", "*.doc", "*.docm", "*.docx", "*.dot", "*.dotm",
19    "*.dotx", "*.drv", "*.eml", "*.eps", "*.exe", "*.flac", "*.gif",
20    "*.go", "*.gz", "*.h", "*.hpp", "*.htm", "*.html", "*.ico", "*.ics",
21    "*.ini", "*.iso", "*.jar", "*.java", "*.jpeg", "*.jpg", "*.js", "*.json",
22    "*.key", "*.ksh", "*.ldf", "*.lib", "*.log", "*.lnk", "*.m4a", "*.m4v",
23    "*.md", "*.mdb", "*.mdf", "*.mht", "*.mhtml", "*.mkv", "*.mov", "*.mp3",
24    "*.mp4", "*.mpeg", "*.mpg", "*.msi", "*.msix", "*.msixbundle", "*.msg",
25    "*.odp", "*.ods", "*.odt", "*.one", "*.ost", "*.otf", "*.pdf", "*.pem",
26    "*.pfx", "*.php", "*.pif", "*.pl", "*.png", "*.pot", "*.potm", "*.potx",
27    "*.ppam", "*.pps", "*.ppsm", "*.ppsx", "*.ppt", "*.pptm", "*.pptx", "*.ps1",
28    "*.ps1xml", "*.psd1", "*.psm1", "*.pst", "*.pub", "*.py", "*.pyc", "*.rar",
29    "*.reg", "*.rpm", "*.rss", "*.rtf", "*.scr", "*.sh", "*.sql", "*.svg",
30    "*.swift", "*.sys", "*.tar", "*.tgz", "*.tif", "*.tiff", "*.toml", "*.ttf",
31    "*.txt", "*.url", "*.vb", "*.vbe", "*.vbs", "*.vcxproj", "*.vhd", "*.vhdx",
32    "*.wav", "*.webm", "*.webp", "*.wim", "*.wsf", "*.xlam", "*.xls", "*.xlsb",
33    "*.xlsm", "*.xlsx", "*.xlt", "*.xltm", "*.xltx", "*.xml", "*.xps",
34    "*.yaml", "*.yml"
35)
36BY Filesystem.action Filesystem.dest
37    Filesystem.file_access_time Filesystem.file_create_time
38    Filesystem.file_hash Filesystem.file_modify_time
39    Filesystem.file_name Filesystem.file_path
40    Filesystem.file_acl Filesystem.file_size
41    Filesystem.process_guid Filesystem.process_id
42    Filesystem.user Filesystem.vendor_product
43
44| `drop_dm_object_name(Filesystem)`
45
46| rex field=file_name "(?<file_extension>(\.[^\.]+){1,2})$"
47
48| lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Extensions Name
49
50| search Name !=False
51
52| stats min(firstTime) as firstTime
53        max(lastTime) as lastTime
54        dc(file_path) as path_count
55        dc(file_name) as file_count
56        values(action) as action
57        values(file_access_time) as file_access_time
58        values(file_create_time) as file_create_time
59        values(file_hash) as file_hash
60        values(file_modify_time) as file_modify_time
61        values(file_acl) as file_acl
62        values(file_size) as file_size
63        values(file_path) as file_path
64        values(process_guid) as process_guid
65        values(process_id) as process_id
66        values(user) as user
67        values(vendor_product) as vendor_product
68        values(file_name) as file_name
69        values(file_extension) as file_extension
70        values(Name) as Name
71  by dest
72
73| where path_count > 1 OR file_count > 20
74
75| `common_ransomware_extensions_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_summariesonly	`summariesonly=`summariesonly_config `allow_old_summaries=`oldsummaries_config `fillnull_value=`fillnull_config``
common_ransomware_extensions_filter	`search *`

common_ransomware_extensions_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1485	Data Destruction	Impact

Actions on Objectives

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	Yes

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data model node. To see the additional metadata, add the following fields, if not already present, please review the detailed documentation on how to create a new field within Mission Control Queue

Known False Positives

It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions.

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack.	user	user	50

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
The device $dest$ wrote $file_count$ files to $path_count$ path(s) with the $file_extension$ extension. This extension and behavior may indicate a $Name$ ransomware attack.	dest	system	50

References

https://github.com/splunk/security_content/issues/2448

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 22