Add new rule to detect ransomware disabling backup/recovery services#1122
Add new rule to detect ransomware disabling backup/recovery services#11220ameyasr wants to merge 4 commits intomandiant:masterfrom
Conversation
| description: the sample attempts to disable and stop backup and recovery services | ||
| scopes: | ||
| static: file | ||
| dynamic: unsupported |
There was a problem hiding this comment.
Does the rule also work for function and call/span of calls scopes?
There was a problem hiding this comment.
So I initially had tested the rule with scope static: function, and the rule failed to detect numerous obvious stop attempts in the Ryuk sample (because they were distributed across functions in the file), which I was using to verify whether it worked. I designed this rule for static analysis only (also primarily why I marked dynamic as unsupported, if that is acceptable) rather than runtime API calls, though a separate one for the latter could be written too.
impact/inhibit-system-recovery/disable-backup-or-recovery-services.yml
Outdated
Show resolved
Hide resolved
|
(Edited, Update / Commit 3) I had this misunderstanding about the way the rule was detecting feature patterns in the file scope. Per my initial logic I had originally thought the rule would solely detect occurences in the pattern "stop_command service_name" as a local string together wherever present in the file, while it also actually allowed the stop command and service name to be present in separate locations in the file. I believe this would have increased false positives considerably, which is why I resorted to simplifying the feature rules to match the above pattern correctly. I think this is more precise than the earlier version. The scope of the rule still remains |
2 participants
(Addresses issue #1048) Added a new rule to namespace
impact/inhibit-system-recovery, namelydisable-backup-or-recovery-services; Passes lints & references an existing sample incapa/testfiles(Ryuk / b87e9dd18a5533a09d3e48a7a1efbcf6.exe_). It aims to detect ransomware samples attempting to open and stop common backup or recovery services upon infection through static analysis of the sample's file scope. For patterns and mitigation, it refers Kasperky crimeware reports in pages 89/90.Edit (Commit 2): Renamed rule to 'stop-backup-or-recovery-services' from 'disable-backup-or-recovery-services'
Edit (Commit 3): Fixed an initial misunderstanding I had about scope, potentially increasing detection precision