GitHub Repo

Analytics Story: Rhysida Ransomware

Updated Date: 2026-05-13 ID: 0925ee49-1185-4484-94ac-7867764a9183 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Utilize analytics designed to identify and delve into atypical behaviors, potentially associated with the Rhysida Ransomware. Employing these searches enables the detection of irregular patterns or actions within systems or networks, serving as proactive measures to spot potential indicators of compromise or ongoing threats. By implementing these search strategies, security analysts can effectively pinpoint anomalous activities, such as unusual file modifications, deviations in system behavior, that could potentially signify the presence or attempt of Rhysida Ransomware infiltration. These searches serve as pivotal tools in the arsenal against such threats, aiding in swift detection, investigation, and mitigation efforts to counter the impact of the Rhysida Ransomware or similar malicious entities.

Why it matters

This story addresses Rhysida ransomware. Rhysida Ransomware emerges as a silent predator, infiltrating systems stealthily and unleashing havoc upon its victims. Employing sophisticated encryption tactics, it swiftly locks critical files and databases, holding them hostage behind an impenetrable digital veil. The haunting demand for ransom sends shockwaves through affected organizations, rendering operations inert and plunging them into a tumultuous struggle between compliance and resilience. Threat actors leveraging Rhysida ransomware are known to impact "targets of opportunity," including victims in the education, healthcare, manufacturing, information technology, and government sectors. Open source reporting details similarities between Vice Society activity and the actors observed deploying Rhysida ransomware. Additionally, open source reporting has confirmed observed instances of Rhysida actors operating in a ransomware-as-a-service (RaaS) capacity, where ransomware tools and infrastructure are leased out in a profit-sharing model. Any ransoms paid are then split between the group and the affiliates.

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
Executables Or Script Creation In Suspicious Path Masquerading Anomaly
System User Discovery With Whoami System Owner/User Discovery Hunting
CMD Carry Out String Command Parameter Windows Command Shell Hunting
Windows Modify Registry NoChangingWallPaper Modify Registry TTP
Windows Group Discovery Via Net Local Groups, Domain Groups Hunting
Suspicious wevtutil Usage Clear Windows Event Logs TTP
Windows Eventlog Cleared Via Wevtutil Clear Windows Event Logs Anomaly
Detect Renamed PSExec Service Execution Hunting
Ntdsutil Export NTDS NTDS TTP
Windows PowerView AD Access Control List Enumeration Permission Groups Discovery, Domain Accounts TTP
Windows Cmdline Tool Execution From Non-Shell Process JavaScript Anomaly
Disable Logs Using WevtUtil Clear Windows Event Logs TTP
Executables Or Script Creation In Temp Path Masquerading Anomaly
Windows PUA Named Pipe SMB/Windows Admin Shares, Process Injection, Inter-Process Communication Anomaly
Common Ransomware Extensions Data Destruction TTP
WinRM Spawning a Process Exploit Public-Facing Application TTP
Windows Excessive Usage Of Net App Account Access Removal Anomaly
NLTest Domain Trust Discovery Domain Trust Discovery TTP
Detect PsExec With accepteula Flag SMB/Windows Admin Shares TTP
Windows PowerView SPN Discovery Kerberoasting TTP
SAM Database File Access Attempt Security Account Manager Hunting
Ransomware Notes bulk creation Data Encrypted for Impact Anomaly
Windows Sensitive Group Discovery With Net Domain Groups Anomaly
Spike in File Writes None Anomaly
Windows PowerView Constrained Delegation Discovery Remote System Discovery TTP
Domain Controller Discovery with Nltest Remote System Discovery TTP
Deleting Shadow Copies Inhibit System Recovery TTP
SecretDumps Offline NTDS Dumping Tool NTDS TTP
Detect Rare Executables User Execution Anomaly
Common Ransomware Notes Data Destruction Hunting
Windows PowerView Unconstrained Delegation Discovery Remote System Discovery TTP
Detect Zerologon via Zeek Exploit Public-Facing Application TTP
Modification Of Wallpaper Defacement TTP
Malicious Powershell Executed As A Service Service Execution TTP
High Process Termination Frequency Data Encrypted for Impact Anomaly
Scheduled Task Deleted Or Created via CMD Scheduled Task Anomaly
PowerShell 4104 Hunting PowerShell Hunting
Windows PowerView Kerberos Service Ticket Request Kerberoasting TTP
Windows Suspicious Process File Path Match Legitimate Resource Name or Location, Create or Modify System Process TTP
Windows Rundll32 Apply User Settings Changes Rundll32 Anomaly

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
Sysmon EventID 11 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
CrowdStrike ProcessRollup2 Other crowdstrike:events:sensor crowdstrike
Windows Event Log Security 4688 Windows icon Windows XmlWinEventLog XmlWinEventLog:Security
Sysmon EventID 1 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 13 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Powershell Script Block Logging 4104 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
Sysmon EventID 17 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 18 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Windows Event Log Security 4663 Windows icon Windows XmlWinEventLog XmlWinEventLog:Security
Windows Event Log System 7045 Windows icon Windows XmlWinEventLog XmlWinEventLog:System
Sysmon EventID 5 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

References

Source: GitHub | Version: 2