Name:Windows High File Deletion Frequency id:45b125c4-866f-11eb-a95a-acde48001122 version:4 date:2024-09-30 author:Teoderick Contreras, Splunk, Steven Dick status:production type:Anomaly Description:The following analytic identifies a high frequency of file deletions by monitoring Sysmon EventCodes 23 and 26 for specific file extensions. This detection leverages Sysmon logs to track deleted target filenames, process names, and process IDs. Such activity is significant as it often indicates ransomware behavior, where files are encrypted and the originals are deleted. If confirmed malicious, this activity could lead to extensive data loss and operational disruption, as ransomware can render critical files inaccessible, demanding a ransom for their recovery. Data_source:
-Sysmon EventID 23
-Sysmon EventID 26
search:`sysmon` EventCode IN ("23","26") TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.jpg", "*.jpeg", "*.db", "*.ps1", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx", "*.bmp","*.zip", "*.rar", "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat", "*.bkf" , "*.backup*", "*.dsk", "*.win") NOT TargetFilename IN ("*\\INetCache\\Content.Outlook\\*") | stats count, values(TargetFilename) as deleted_files, min(_time) as firstTime, max(_time) as lastTime by user, dest, signature, signature_id, Image, process_name, process_guid | rename Image as process | where count >=100 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_high_file_deletion_frequency_filter`
how_to_implement:To successfully implement this search, you need to ingest logs that include the deleted target file name, process name, and process ID from your endpoints. If you are using Sysmon, ensure you have at least version 2.0 of the Sysmon TA installed. known_false_positives:Users may delete a large number of pictures or files in a folder, which could trigger this detection. Additionally, heavy usage of PowerBI and Outlook may also result in false positives. References: -https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft -https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html -https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ drilldown_searches: name:'View the detection results for - "$user$" and "$dest$"' search:'%original_detection_search% | search user = "$user$" dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$user$" and "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Clop Ransomware' - 'DarkCrystal RAT' - 'Swift Slicer' - 'Data Destruction' - 'WhisperGate' - 'Sandworm Tools' - 'Handala Wiper' asset_type:Endpoint confidence:80 impact:90 message:Elevated file deletion rate observed from process [$process_name$] on machine $dest$ mitre_attack_id: - 'T1485' observable: name:'user' type:'User' - role: - 'Victim' name:'dest' type:'Endpoint' - role: - 'Victim' name:'deleted_files' type:'File Name' - role: - 'Attacker' name:'process_name' type:'Process' - role: - 'Attacker' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - 'EventCode' - 'TargetFilename' - 'dest' - 'user' - 'Image' - 'ProcessID' - '_time' risk_score:72 security_domain:endpoint