Techniques
Sample rules
Ryuk Test Files Detected
- source: splunk
- technicques:
- T1486
Description
The search looks for files that contain the key word Ryuk under any folder in the C drive, which is consistent with Ryuk propagation.
Detection logic
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem WHERE "Filesystem.file_path"=C:\\*Ryuk* BY "Filesystem.dest", "Filesystem.user", "Filesystem.file_path"
| `drop_dm_object_name(Filesystem)`
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `ryuk_test_files_detected_filter`