---
title: Conti-Style Ransomware Mass File Encryption Pattern
id: 8b4f3a1c-7d2e-4f5a-9b3c-1d2e3f4a5b6c
status: experimental
description: Detects rapid encryption of multiple files consistent with Conti ransomware behavior by monitoring process creation with file access patterns.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2024/06/18
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
  filter:
    ParentImage|contains:
      - '\Program Files\'
      - '\Windows\System32\'
  condition: selection and not filter
falsepositives:
  - Legitimate batch file operations
  - System administration tasks
level: high
---
title: Conti Affiliate Cobalt Strike Lateral Movement
id: 3c9e8f2a-1b4d-4a7e-9c5f-2d3e4f5a6b7c
status: experimental
description: Detects Cobalt Strike Beacon activity commonly used by Conti operators for lateral movement and command execution.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2024/06/18
tags:
  - attack.execution
  - attack.t1059.003
  - attack.lateral_movement
  - attack.t1021.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort:
      - 443
      - 80
      - 8443
  filter_legitimate:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\edge.exe'
      - '\iexplore.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate web browsing
  - Corporate application traffic
level: medium
---
title: Ransomware Double-Extortion Data Exfiltration Preparation
id: 7d2e3f4a-5b6c-7d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects preparation for data exfiltration consistent with ransomware double-extortion tactics including archiving and large file transfers.
references:
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2024/06/18
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: file_event
  product: windows
detection:
  selection_archive:
    TargetFilename|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
  selection_rclone:
    Image|endswith:
      - '\rclone.exe'
  selection_wget:
    Image|endswith:
      - '\wget.exe'
      - '\curl.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate archiving operations
  - Valid administrative tool usage
level: high

// Hunt for Conti-style ransomware precursor activity
// Detects multiple high-risk behaviors within a 24-hour window
let timeframe = 1d;
let accountLookback = 14d;
// Detect unusual lateral movement and SMB access
let SuspiciousSMBAccess =
    DeviceNetworkEvents
    | where Timestamp > ago(timeframe)
    | where RemotePort == 445
    | where ActionType in ("FileCreated", "FileAccessed")
    | summarize count() by DeviceName, InitiatingProcessAccountName, RemoteIP
    | where count_ > 100;
// Detect mass file encryption patterns
let RapidFileEncryption =
    DeviceFileEvents
    | where Timestamp > ago(timeframe)
    | where ActionType == "FileCreated"
    | where InitiatingProcessFileName in ("cmd.exe", "powershell.exe", "wscript.exe", "rundll32.exe", "mshta.exe")
    | summarize count() by DeviceName, InitiatingProcessAccountName, InitiatingProcessFolderPath
    | where count_ > 50;
// Detect security product tampering
let SecurityToolTampering =
    DeviceProcessEvents
    | where Timestamp > ago(timeframe)
    | where ProcessCommandLine contains "sc stop" 
        or ProcessCommandLine contains "net stop" 
        or ProcessCommandLine contains "Set-MpPreference"
    | where ProcessCommandLine contains any_(
        "Defender", "CrowdStrike", "SentinelOne", "Sophos", "FireEye", "Symantec", 
        "McAfee", "TrendMicro", "Kaspersky", "ESET")
    | summarize count() by DeviceName, AccountName, ProcessCommandLine;
// Detect credential dumping behavior
let CredentialDumping =
    DeviceProcessEvents
    | where Timestamp > ago(timeframe)
    | where FileName in ("mimikatz.exe", "procdump.exe", "rundll32.exe", "taskmgr.exe")
    | where ProcessCommandLine contains "lsass" 
        or ProcessCommandLine contains "sekurlsa" 
        or ProcessCommandLine contains "mini"
    | project DeviceName, AccountName, ProcessCommandLine;
// Correlate indicators for potential Conti ransomware activity
SuspiciousSMBAccess
| join kind=inner (RapidFileEncryption) on DeviceName
| join kind=inner (SecurityToolTampering) on DeviceName
| project DeviceName, InitiatingProcessAccountName, RemoteIP, Timestamp
| distinct *
| extend DetectionTime = now(), AlertType = "Potential Conti-Style Ransomware Activity"

-- Hunt for Conti ransomware precursor activity on endpoints
-- Detect processes and files indicative of ransomware preparation

-- Detect recently created suspicious processes
SELECT
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime
FROM pslist()
WHERE Name IN (
        'cmd.exe', 'powershell.exe', 'wscript.exe', 'rundll32.exe', 
        'mshta.exe', 'certutil.exe', 'bitsadmin.exe', 'regsvr32.exe'
    )
    AND CreateTime > now() - 24h
    AND (
        CommandLine =~ '-enc' OR
        CommandLine =~ 'FromBase64String' OR
        CommandLine =~ 'IEX' OR
        CommandLine =~ 'Invoke-Expression' OR
        CommandLine =~ 'DownloadString' OR
        CommandLine =~ '/c ' OR
        CommandLine =~ 'powershell -'
    )

-- Detect mass file creation patterns (potential encryption)
SELECT 
    FullPath,
    Size,
    Mode.String,
    Mtime,
    Btime
FROM glob(globs='/*/*.*', root='C:\')
WHERE Mode.String =~ 'r' 
    AND Mtime > now() - 24h 
    AND FullPath =~ '\.lock' OR FullPath =~ '\.enc' OR FullPath =~ '\.crypt' OR FullPath =~ '\.encrypted'
LIMIT 1000

-- Detect modifications to critical security registry keys
SELECT
    KeyPath,
    Name,
    Data,
    LastWriteTime
FROM registry()
WHERE KeyPath =~ 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services'
    AND LastWriteTime > now() - 24h
    AND Name =~ 'Start'
    AND Data IN (4, 3)

# Conti Ransomware Hardening and Detection Script
# Run with elevated privileges

# Function to write output with timestamp
function Write-Log {
    param([string]$Message)
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    Write-Host "[$timestamp] $Message" -ForegroundColor Cyan
}

# Check for suspicious processes associated with Conti operations
Write-Log "Checking for suspicious ransomware-related processes..."
$suspiciousProcesses = @(
    "mimikatz.exe",
    "procdump.exe",
    "rclone.exe",
    "pskill.exe",
    "psexec.exe",
    "anydesk.exe",
    "supremo.exe",
    "ammyy.exe"
)

$foundProcesses = Get-Process | Where-Object { 
    $suspiciousProcesses -contains $_.ProcessName.ToLower() 
}

if ($foundProcesses) {
    Write-Log "ALERT: Suspicious processes detected: $($foundProcesses.ProcessName -join ', ')"
    $foundProcesses | Format-Table Id, ProcessName, Path, StartTime -AutoSize
} else {
    Write-Log "No suspicious processes detected."
}

# Check for mass file encryption indicators
Write-Log "Scanning for potential encrypted file indicators..."
$encryptedExtensions = @('*.lock', '*.enc', '*.crypt', '*.encrypted', '*.Locked')
$driveLetters = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($drive in $driveLetters) {
    foreach ($ext in $encryptedExtensions) {
        $files = Get-ChildItem -Path $drive -Filter $ext -Recurse -ErrorAction SilentlyContinue -Depth 2
        if ($files) {
            Write-Log "ALERT: Found potential encrypted files in $drive with extension $ext: $($files.Count) files"
        }
    }
}

# Audit and protect critical services
Write-Log "Checking status of critical security services..."
$securityServices = @(
    @{Name="WinDefend"; DisplayName="Windows Defender Antivirus"},
    @{Name="WdNisSvc"; DisplayName="Windows Defender Network Inspection Service"},
    @{Name="Sense"; DisplayName="Windows Defender Advanced Threat Protection"},
    @{Name="EventLog"; DisplayName="Windows Event Log"}
)

foreach ($svc in $securityServices) {
    $service = Get-Service -Name $svc.Name -ErrorAction SilentlyContinue
    if ($service) {
        if ($service.Status -ne "Running") {
            Write-Log "WARNING: $($svc.DisplayName) is not running. Current status: $($service.Status)"
            try {
                Start-Service -Name $svc.Name -ErrorAction Stop
                Write-Log "Successfully started $($svc.DisplayName)"
            } catch {
                Write-Log "ERROR: Failed to start $($svc.DisplayName): $_"
            }
        } else {
            Write-Log "OK: $($svc.DisplayName) is running."
        }
    } else {
        Write-Log "WARNING: Service $($svc.Name) not found."
    }
}

# Check for Remote Desktop Services (common Conti attack vector)
Write-Log "Checking Remote Desktop Services security..."
$rdpService = Get-Service -Name "TermService" -ErrorAction SilentlyContinue
if ($rdpService) {
    if ($rdpService.Status -eq "Running") {
        Write-Log "WARNING: Remote Desktop Services is running. Consider disabling if not required."
        Write-Log "RDP Security Recommendations:"
        Write-Log "- Enable Network Level Authentication (NLA)"
        Write-Log "- Enforce account lockout policies"
        Write-Log "- Implement MFA for RDP access"
        Write-Log "- Use VPN or jump hosts for remote access"
    }
}

# Check for SMBv1 (legacy protocol often exploited)
Write-Log "Checking SMBv1 status..."
$smbv1Feature = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
if ($smbv1Feature -and $smbv1Feature.State -eq "Enabled") {
    Write-Log "WARNING: SMBv1 protocol is enabled. This is a significant security risk."
    Write-Log "Consider disabling with: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol"
}

# Check PowerShell execution policies
Write-Log "Checking PowerShell execution policies..."
$policy = Get-ExecutionPolicy -List
foreach ($p in $policy) {
    if ($p.ExecutionPolicy -eq "Unrestricted" -or $p.ExecutionPolicy -eq "Bypass") {
        Write-Log "WARNING: $($p.Scope) scope has ExecutionPolicy set to $($p.ExecutionPolicy)."
    }
}

# Create a baseline hash of critical directories for future comparison
Write-Log "Creating baseline file hashes for monitoring..."
$monitorPaths = @(
    "$env:SystemRoot\System32",
    "$env:ProgramFiles",
    "$env:ProgramData"
)

foreach ($path in $monitorPaths) {
    if (Test-Path $path) {
        Write-Log "Hashing files in $path..."
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { -not $_.PSIsContainer } | 
        ForEach-Object {
            try {
                $hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
                [PSCustomObject]@{
                    Path = $_.FullName
                    Hash = $hash.Hash
                    Size = $_.Length
                    Modified = $_.LastWriteTime
                }
            } catch {
                # Skip files that can't be accessed
            }
        } | Export-Csv -Path "$env:TEMP\SecurityArsenal-Baseline-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
        Write-Log "Baseline saved to $env\TEMP\SecurityArsenal-Baseline-$(Get-Date -Format 'yyyyMMdd').csv"
    }
}

Write-Log "Conti Ransomware Hardening and Detection Script completed."
Write-Log "Please review the output above and take appropriate action for any WARNING or ALERT messages."

   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "EnableTranscripting" -Value 1
   Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" -Name "OutputDirectory" -Value "C:\Logs\PowerShell"

   Set-MpPreference -EnableControlledFolderAccess Enabled
   Add-MpPreference -ControlledFolderAccessProtectedFolders "C:\Users\%USERNAME%\Documents"
   Add-MpPreference -ControlledFolderAccessProtectedFolders "C:\Users\%USERNAME%\Desktop"