The search looks for file writes with extensions consistent with a SamSam ransomware attack.
- Type: TTP
- Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- Datamodel: Endpoint- Datasource: Splunk Add-on for Sysmon
- Last Updated: 2018-12-14
- Author: Rico Valdez, Splunk
- ID: 02c6cfc2-ae66-4735-bfc7-6291da834cbf
Kill Chain Phase
- CIS 8
1 2 3 4 5 6 7 8 | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | rex field=file_name "(?<file_extension>\.[^\.]+)$" | search file_extension=.stubbin OR file_extension=.berkshire OR file_extension=.satoshi OR file_extension=.sophos OR file_extension=.keyxml | `file_with_samsam_extension_filter`
The SPL above uses the following Macros:
file_with_samsam_extension_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
How To Implement
You must be ingesting data that records file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
Known False Positives
Because these extensions are not typically used in normal operations, you should investigate all results.
Associated Analytic story
|90.0||100||90||File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$|
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
source | version: 1