attack.t1486 | Detection.FYI

Load Of RstrtMgr.DLL By A Suspicious Process

Nov 28, 2023 · attack.impact attack.defense_evasion attack.t1486 attack.t1562.001 ·
Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Read More
Load Of RstrtMgr.DLL By An Uncommon Process

Nov 28, 2023 · attack.impact attack.defense_evasion attack.t1486 attack.t1562.001 ·
Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Read More
Suspicious Appended Extension

Nov 15, 2023 · attack.impact attack.t1486 ·
Share on:

Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.

Read More
Portable Gpg.EXE Execution

Nov 10, 2023 · attack.impact attack.t1486 ·
Share on:

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Read More
BlueSky Ransomware Artefacts

Oct 26, 2023 · attack.impact attack.t1486 detection.emerging_threats ·
Share on:

Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.

Read More
WannaCry Ransomware Activity

Oct 18, 2023 · attack.lateral_movement attack.t1210 attack.discovery attack.t1083 attack.defense_evasion attack.t1222.001 attack.impact attack.t1486 attack.t1490 detection.emerging_threats ·
Share on:

Detects WannaCry ransomware activity

Read More
Suspicious Reg Add BitLocker

Oct 17, 2023 · attack.impact attack.t1486 ·
Share on:

Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Read More
AWS EC2 Disable EBS Encryption

Oct 12, 2023 · attack.impact attack.t1486 attack.t1565 ·
Share on:

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Read More
Microsoft 365 - Potential Ransomware Activity

Oct 12, 2023 · attack.impact attack.t1486 ·
Share on:

Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.

Read More
Renamed Gpg.EXE Execution

Aug 9, 2023 · attack.impact attack.t1486 ·
Share on:

Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

Read More
LockerGoga Ransomware Activity

Jun 20, 2023 · attack.impact attack.t1486 detection.emerging_threats ·
Share on:

Detects LockerGoga ransomware activity via specific command line.

Read More
Potential Conti Ransomware Activity

Jun 20, 2023 · attack.impact attack.s0575 attack.t1486 detection.emerging_threats ·
Share on:

Detects a specific command used by the Conti ransomware group

Read More
Suspicious Multiple File Rename Or Delete Occurred

Apr 21, 2023 · attack.impact attack.t1486 ·
Share on:

Detects multiple file rename or delete events occurrence within a specified period of time by a same user (these events may signalize about ransomware activity).

Read More
Antivirus Ransomware Detection

Feb 3, 2023 · attack.t1486 ·
Share on:

Detects a highly relevant Antivirus alert that reports ransomware

Read More
Suspicious Creation TXT File in User Desktop

Jan 27, 2023 · attack.impact attack.t1486 ·
Share on:

Ransomware create txt file in the user Desktop

Read More
Vice Society Encrypted File Extension File Creation

Nov 29, 2022 · attack.impact attack.t1486 ·
Share on:

Detects creation of potentially-encrypted files by Vice Society ransomeware. As this is based only on file extensions, the analyst should investigate surrounding activity to validate that this is not part of a benign applicatoin.

Read More