BlueSky Ransomware Artefacts

Status: test
Severity: high
Log source: product windows, service security
Author: j4son
Source: github.com/SigmaHQ/sigma

Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1486` Data Encrypted for Impact

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4656: A handle to an object was requested.
Security-Auditing	Event ID 4663: An attempt was made to access an object.
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: BlueSky Ransomware Artefacts
id: eee8311f-a752-44f0-bf2f-6b007db16300
status: test
description: Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.
references:
    - https://unit42.paloaltonetworks.com/bluesky-ransomware/
author: j4son
date: 2023-05-23
tags:
    - attack.impact
    - attack.t1486
    - detection.emerging-threats
logsource:
    product: windows
    service: security
detection:
    selection_access_eid:
        EventID:
            - 4663
            - 4656
    selection_access_data:
        - ObjectName|endswith: '.bluesky'
        - ObjectName|contains: 'DECRYPT FILES BLUESKY'
    selection_share_eid:
        EventID: 5145
    selection_share_data:
        - RelativeTargetName|endswith: '.bluesky'
        - RelativeTargetName|contains: 'DECRYPT FILES BLUESKY'
    condition: all of selection_access_* or all of selection_share_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_access_* or all of selection_share_*

Stage 1: `selection_access_eid`

selection_access_eid:
    EventID:
        - 4663
        - 4656

Stage 2: `selection_access_data`

selection_access_data:
    - ObjectName|endswith: '.bluesky'
    - ObjectName|contains: 'DECRYPT FILES BLUESKY'

Stage 3: `selection_share_eid`

selection_share_eid:
    EventID: 5145

Stage 4: `selection_share_data`

selection_share_data:
    - RelativeTargetName|endswith: '.bluesky'
    - RelativeTargetName|contains: 'DECRYPT FILES BLUESKY'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	ends_with	`.bluesky`	`field:"ObjectName" kind:ends_with value:".bluesky"`
`ObjectName`	match	`DECRYPT FILES BLUESKY`	`field:"ObjectName" kind:match value:"DECRYPT FILES BLUESKY"`
`RelativeTargetName`	ends_with	`.bluesky`	`field:"RelativeTargetName" kind:ends_with value:".bluesky"`
`RelativeTargetName`	match	`DECRYPT FILES BLUESKY`	`field:"RelativeTargetName" kind:match value:"DECRYPT FILES BLUESKY"`

BlueSky Ransomware Artefacts

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_access_eid

Stage 2: selection_access_data