SANS Ransomware Summit 2022, Can You Detect This?
Tags
Common Information
| Type | Value |
|---|---|
| UUID | b7f9e8cc-34bb-4a1a-aa5b-fb1279718cf6 |
| Fingerprint | f6c52b8e33b9aca3 |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | June 16, 2022, 2:20 p.m. |
| Added to db | Sept. 11, 2022, 12:38 p.m. |
| Last updated | Nov. 17, 2024, 11:40 p.m. |
| Headline | SANS Ransomware Summit 2022, Can You Detect This? |
| Title | SANS Ransomware Summit 2022, Can You Detect This? |
| Detected Hints/Tags/Attributes | 84/1/33 |
Source URLs
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 249 | ✔ | The DFIR Report | https://thedfirreport.com/feed/ | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 4128 | github.com |
|
| Details | Domain | 74 | thedfirreport.com |
|
| Details | Domain | 24 | mega.io |
|
| Details | Domain | 58 | redcanary.com |
|
| Details | Domain | 18 | ufile.io |
|
| Details | File | 459 | regsvr32.exe |
|
| Details | File | 1018 | rundll32.exe |
|
| Details | File | 2126 | cmd.exe |
|
| Details | File | 1208 | powershell.exe |
|
| Details | File | 59 | ntdsutil.exe |
|
| Details | File | 256 | net.exe |
|
| Details | File | 10 | adf.bat |
|
| Details | File | 6 | adfind.bat |
|
| Details | File | 2 | locker.bat |
|
| Details | File | 17 | kill.bat |
|
| Details | File | 1 | def.bat |
|
| Details | File | 32 | start.bat |
|
| Details | File | 12 | shadow.bat |
|
| Details | File | 3 | logdelete.bat |
|
| Details | File | 1 | closeapps.bat |
|
| Details | Github username | 19 | the-dfir-report |
|
| Details | Github username | 6 | countercept |
|
| Details | Github username | 27 | sigmahq |
|
| Details | Url | 1 | https://github.com/the-dfir-report. |
|
| Details | Url | 1 | https://github.com/countercept/chainsaw |
|
| Details | Url | 1 | https://github.com/sigmahq/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_from_proxy_executing_regsvr32_payload.yml |
|
| Details | Url | 1 | https://github.com/sigmahq/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_from_proxy_executing_regsvr32_payload2.yml |
|
| Details | Url | 3 | https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware |
|
| Details | Url | 1 | https://thedfirreport.com/2022/04/25/quantum-ransomware |
|
| Details | Url | 2 | https://github.com/sigmahq/sigma/blob/master/rules/windows/pipe_created/pipe_created_tool_psexec.yml |
|
| Details | Url | 2 | https://github.com/sigmahq/sigma/blob/master/rules/windows/file_event/file_event_win_tool_psexec.yml |
|
| Details | Url | 1 | https://redcanary.com/blog/rclone-mega-extortion |
|
| Details | Url | 1 | https://github.com/the-dfir-report/sigma-rules/blob/main/win_cobaltstrike_operator_bloopers_cmds.yml |