detection.wiki

Detection rules › Sigma

Potential Maze Ransomware Activity

Status
test
Severity
critical
Log source
product windows, category process_creation
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects specific process characteristics of Maze ransomware word document droppers

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1047 Windows Management Instrumentation, T1204.002 User Execution: Malicious File
ImpactT1490 Inhibit System Recovery

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Potential Maze Ransomware Activity
id: 29fd07fc-9cfd-4331-b7fd-cc18dfa21052
status: test
description: Detects specific process characteristics of Maze ransomware word document droppers
references:
    - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
    - https://app.any.run/tasks/51e7185c-52d7-4efb-ac0d-e86340053473/
    - https://app.any.run/tasks/65a79440-373a-4725-8d74-77db9f2abda4/
author: Florian Roth (Nextron Systems)
date: 2020-05-08
modified: 2023-02-13
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1047
    - attack.impact
    - attack.t1490
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    # Dropper
    selection1:
        ParentImage|endswith: '\WINWORD.exe'
        Image|endswith: '.tmp'
    # Binary Execution
    selection2:
        Image|endswith: '\wmic.exe'
        ParentImage|contains: '\Temp\'
        CommandLine|endswith: 'shadowcopy delete'
    # Specific Pattern
    selection3:
        CommandLine|endswith: 'shadowcopy delete'
        CommandLine|contains: '\..\..\system32'
    condition: 1 of selection*
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: condition

1 of selection*

Stage 1: selection1

selection1:
    ParentImage|endswith: '\WINWORD.exe'
    Image|endswith: '.tmp'

Stage 2: selection2

selection2:
    Image|endswith: '\wmic.exe'
    ParentImage|contains: '\Temp\'
    CommandLine|endswith: 'shadowcopy delete'

Stage 3: selection3

selection3:
    CommandLine|endswith: 'shadowcopy delete'
    CommandLine|contains: '\..\..\system32'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • shadowcopy delete
CommandLinematch
  • \..\..\system32
Imageends_with
  • .tmp
  • \wmic.exe corpus 60 (sigma 60)
ParentImageends_with
  • \WINWORD.exe corpus 10 (sigma 10)
ParentImagematch
  • \Temp\ corpus 3 (sigma 3)