Potential Maze Ransomware Activity

Status: test
Severity: critical
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects specific process characteristics of Maze ransomware word document droppers

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation `T1204.002` User Execution: Malicious File
Impact	`T1490` Inhibit System Recovery

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potential Maze Ransomware Activity
id: 29fd07fc-9cfd-4331-b7fd-cc18dfa21052
status: test
description: Detects specific process characteristics of Maze ransomware word document droppers
references:
    - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
    - https://app.any.run/tasks/51e7185c-52d7-4efb-ac0d-e86340053473/
    - https://app.any.run/tasks/65a79440-373a-4725-8d74-77db9f2abda4/
author: Florian Roth (Nextron Systems)
date: 2020-05-08
modified: 2023-02-13
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1047
    - attack.impact
    - attack.t1490
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    # Dropper
    selection1:
        ParentImage|endswith: '\WINWORD.exe'
        Image|endswith: '.tmp'
    # Binary Execution
    selection2:
        Image|endswith: '\wmic.exe'
        ParentImage|contains: '\Temp\'
        CommandLine|endswith: 'shadowcopy delete'
    # Specific Pattern
    selection3:
        CommandLine|endswith: 'shadowcopy delete'
        CommandLine|contains: '\..\..\system32'
    condition: 1 of selection*
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection1`

selection1:
    ParentImage|endswith: '\WINWORD.exe'
    Image|endswith: '.tmp'

Stage 2: `selection2`

selection2:
    Image|endswith: '\wmic.exe'
    ParentImage|contains: '\Temp\'
    CommandLine|endswith: 'shadowcopy delete'

Stage 3: `selection3`

selection3:
    CommandLine|endswith: 'shadowcopy delete'
    CommandLine|contains: '\..\..\system32'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`shadowcopy delete`	`field:"CommandLine" kind:ends_with value:"shadowcopy delete"`
`CommandLine`	match	`\..\..\system32`	`field:"CommandLine" kind:match value:"\..\..\system32"`
`Image`	ends_with	`.tmp` `\wmic.exe` corpus 62 (sigma 62)	`field:"Image" kind:ends_with`
`ParentImage`	ends_with	`\WINWORD.exe` corpus 10 (sigma 10)	`field:"ParentImage" kind:ends_with value:"\WINWORD.exe"`
`ParentImage`	match	`\Temp\` corpus 3 (sigma 3)	`field:"ParentImage" kind:match value:"\Temp\"`

Potential Maze Ransomware Activity

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection1

Stage 2: selection2

Stage 3: selection3

Indicators

Stage 0: `condition`

Stage 1: `selection1`

Stage 2: `selection2`

Stage 3: `selection3`