Detection rules › Splunk
Ransomware Notes bulk creation
The following analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame. This activity is significant as it often indicates an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact | T1486 Data Encrypted for Impact |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 11 | FileCreate |
Stages and Predicates
Stage 1: search
search EventCode=11 file_name IN ("*\.hta", "*\.html", "*\.txt")
Stage 2: search
search span="10s"
Stage 3: stats
stats dc(TargetFilename) AS unique_readme_path_count, … AS list_of_readme_path, … AS action, … AS file_access_time, … AS file_create_time, … AS file_hash, … AS file_modify_time, … AS file_path, … AS file_acl, … AS file_size, … AS process_guid, … AS process_id, … AS user, … AS vendor_product BY dest, file_name
Stage 4: where
where unique_readme_path_count>=15
Stage 5: search
search
Stage 6: search
search
Stage 7: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
file_name | in |
|
span | eq |
|
unique_readme_path_count | ge |
|