Detection rules › Sigma
Vice Society directory crawling script for data exfiltration (via ps_script)
Detects data exfiltration performed by the Vice Society ransomware gang using a custom built PowerShell script. More precisely, the script enumerates the volumes mounted on the system, then starts crawling the different directories before initiating the data exfiltration over HTTP by creating multiple different jobs. As PowerShell script block logs the script execution into multiple events, the detection aggregates the different log chunks using the ScriptBlockId and then ensure that at least 3 of the 4 detection strings are found.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
| Exfiltration | T1041 Exfiltration Over C2 Channel |
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
title: Vice Society directory crawling script for data exfiltration (via ps_script)
description: Detects data exfiltration performed by the Vice Society ransomware gang using a custom built PowerShell script. More precisely, the script enumerates the volumes mounted on the system, then starts crawling the different directories before initiating the data exfiltration over HTTP by creating multiple different jobs. As PowerShell script block logs the script execution into multiple events, the detection aggregates the different log chunks using the ScriptBlockId and then ensure that at least 3 of the 4 detection strings are found.
references:
- https://unit42.paloaltonetworks.com/vice-society-ransomware-powershell/
tags:
- attack.execution
- attack.t1059.001 # Command and Scripting Interpreter: PowerShell
- attack.exfiltration
- attack.t1041 # Exfiltration Over C2 Channel
author: mdecrevoisier
status: stable
logsource:
product: windows
category: ps_script # ID 4104
detection:
selection:
ScriptBlockText|contains|all:
- 'Work( $disk )'
- 'Show( $name )'
- 'CreateJobLocal( $folders )'
- 'fill( [string]$filename )'
condition: selection | count() by ScriptBlockId > 3
falsepositives:
- unknown
level: high
Stages and Predicates
Stage 0: condition
selection | count() by ScriptBlockId > 3Stage 1: selection
selection:
ScriptBlockText|contains|all:
- 'Work( $disk )'
- 'Show( $name )'
- 'CreateJobLocal( $folders )'
- 'fill( [string]$filename )'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ScriptBlockText | match |
|