Advantest Encryption-Based Attack: Detecting and Containing Ransomware in Semiconductor Supply Chains

---
title: Potential Ransomware Activity - Mass File Encryption
id: 8a2c9f11-4e5b-4a9d-8b1c-1e2f3a4b5c6d
status: experimental
description: Detects potential ransomware activity by identifying a single process modifying a high volume of files within a short timeframe.
references:
 - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2025/04/06
tags:
 - attack.impact
 - attack.t1486
logsource:
 product: windows
 category: file_change
detection:
 selection:
   Image|endswith:
     - '.exe'
   TargetFilename|contains:
     - 'C:\Users\'
     - 'C:\ProgramData\'
 condition: selection | count(TargetFilename) by Image > 50
timeframe: 1m
falsepositives:
 - Legitimate software updates or bulk file operations
level: high
---
title: Ransomware Note Creation Patterns
id: 9b3d0a22-5f6c-5b0e-9c2d-2f3g4a5c6d7e
status: experimental
description: Detects the creation of common ransomware note file names or extensions in user directories.
references:
 - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2025/04/06
tags:
 - attack.impact
 - attack.t1486
logsource:
 product: windows
 category: file_create
detection:
 selection:
   TargetFilename|contains:
     - 'ReadMe'
     - 'RECOVER'
     - 'RESTORE'
     - 'files'
     - 'Decrypt'
   TargetFilename|endswith:
     - '.txt'
     - '.hta'
     - '.html'
     - '.png'
falsepositives:
 - Legitimate installation files or documentation
level: medium
---
title: Windows Cipher Utility Used to Wipe Data
id: 1c4e1b33-6g7d-6c1f-0d3e-3g4h5a6d7e8f
status: experimental
description: Detects the use of cipher.exe to wipe data from disk, often used by attackers to prevent recovery or VSS rollback.
references:
 - https://attack.mitre.org/techniques/T1485/
author: Security Arsenal
date: 2025/04/06
tags:
 - attack.impact
 - attack.t1485
logsource:
 product: windows
 category: process_creation
detection:
 selection:
   Image|endswith:
     - '\cipher.exe'
   CommandLine|contains:
     - '/w:'
falsepositives:
 - Legitimate disk cleaning operations by IT staff
level: high

let Threshold = 50;
DeviceFileEvents
| where Timestamp > ago(1h)
| where ActionType == "FileCreated"
| summarize FileCount = count() by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 1m)
| where FileCount > Threshold
| project DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, FileCount, Timestamp
| order by FileCount desc

-- Hunt for suspicious processes with high handle counts (potential encryption)
SELECT Pid, Name, CommandLine, Handles, Exe
FROM pslist()
WHERE Handles > 1000
   AND Name NOT IN ('svchost.exe', 'explorer.exe', 'chrome.exe', 'msedge.exe', 'firefox.exe')

-- Hunt for ransom notes in common user directories
SELECT FullPath, Mtime, Size
FROM glob(globs='/*/*.txt', root='C:\Users')
WHERE FullPath =~ '(?i)readme|restore|decrypt|recover|files'

<#
.SYNOPSIS
    Rapid Triage for Ransomware Indicators.
.DESCRIPTION
    Checks for mass file changes in user directories and verifies Volume Shadow Copy status.
#>

# Check for suspicious file extensions in user profiles (e.g., .locked, .enc)
Write-Host "[+] Scanning for suspicious encrypted files..."
$suspiciousExtensions = @('*.locked', '*.enc', '*.crypto', '*.locked1', '*.encrypted')
$userProfiles = Get-ChildItem "C:\Users" -Directory

foreach ($profile in $userProfiles) {
    foreach ($ext in $suspiciousExtensions) {
        $files = Get-ChildItem -Path $profile.FullName -Filter $ext -Recurse -ErrorAction SilentlyContinue
        if ($files.Count -gt 0) {
            Write-Host "[!] ALERT: Found $($files.Count) files matching '$ext' in $($profile.FullName)" -ForegroundColor Red
        }
    }
}

# Check Volume Shadow Copy Service status
Write-Host "[+] Checking Volume Shadow Copy (VSS) status..."
$vss = vssadmin list shadows 2>&1
if ($vss -match "No shadow copies found" -or $vss -match "Error") {
    Write-Host "[!] WARNING: No shadow copies found or VSS error detected. Possible VSS wiping." -ForegroundColor Yellow
} else {
    Write-Host "[+] Shadow copies appear to be present." -ForegroundColor Green
}