Defending Against Encryption-Based Attacks: Lessons from the Change Healthcare Incident

---
title: Potential Ransomware Note Creation
id: 9e8a7f12-3b4c-4d5e-8f9a-1b2c3d4e5f6a
status: experimental
description: Detects the creation of potential ransomware note files on the endpoint, often indicators of encryption activity completion.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'README'
      - 'RESTORE'
      - 'RECOVER'
      - 'DECRYPT'
      - 'YOUR_FILES'
      - 'HOW_TO'
    TargetFilename|endswith:
      - '.txt'
      - '.hta'
      - '.html'
  condition: selection
falsepositives:
  - Legitimate administrative documentation (rare)
level: high
---
title: Shadow Copy Deletion Via Vssadmin
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to delete shadow copies using vssadmin.exe, a common tactic used by ransomware to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  condition: selection
falsepositives:
  - System administrators managing disk space (verify context)
level: critical
---
title: Suspicious PowerShell Execution IEX Download
id: b2c3d4e5-f6a7-4b5c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell commands that download and execute code (IEX), often used to stage ransomware payloads.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2024/05/20
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-Expression'
      - 'IEX('
      - 'DownloadString'
  condition: selection
falsepositives:
  - Legitimate software installation scripts
level: high

// Detect Shadow Copy Deletion attempts
DeviceProcessEvents  
| where Timestamp > ago(1d)  
| where ProcessCommandLine contains "delete"  
| where ProcessCommandLine contains "shadow"  
| where FileName =~ "vssadmin.exe" or FileName =~ "wmic.exe"  
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName


// Detect bulk file modifications (Potential Encryption)
// Note: This requires Microsoft Defender for Identity or advanced file auditing
DeviceFileEvents  
| where Timestamp > ago(1h)  
| where ActionType == "FileCreated" or ActionType == "FileModified"  
| summarize Count = count() by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, bin(Timestamp, 5m)  
| where Count > 50 // Threshold for bulk operations
| project Timestamp, DeviceName, InitiatingProcessFileName, Count

-- Hunt for common ransomware note file extensions
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/**/*.{txt,hta,html,inf}')
WHERE FileName =~ '(?i)(readme|restore|recover|decrypt|files)'

-- Hunt for processes with suspicious command line arguments involving encryption or deletion
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE CommandLine =~ 'vssadmin.*delete' 
   OR CommandLine =~ 'wbadmin.*delete'
   OR CommandLine =~ 'bcdedit.*recoveryenabled no'

<#
.SYNOPSIS
    Checks for common ransomware indicators on a local system.
.DESCRIPTION
    This script scans the C: drive for ransom notes and checks for recent shadow copy deletions in the event log.
#>

Write-Host "[+] Checking for common ransom note patterns..." -ForegroundColor Cyan

$paths = @("C:\Users\", "C:\ProgramData\", "C:\")
$patterns = @("*readme*.txt", "*decrypt*.*", "*restore*.*", "*how_to*.*")

$found = $false
foreach ($path in $paths) {
    Get-ChildItem -Path $path -Include $patterns -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        Write-Host "[!] Potential ransom note found: $($_.FullName)" -ForegroundColor Red
        $found = $true
    }
}

if (-not $found) {
    Write-Host "[-] No obvious ransom notes found." -ForegroundColor Green
}

Write-Host "[+] Checking Event Logs for VSSAdmin deletion events..." -ForegroundColor Cyan

$events = Get-WinEvent -FilterHashtable @{LogName='System'; ID=7036} -MaxEvents 1000 -ErrorAction SilentlyContinue | 
    Where-Object { $_.Message -like '*vss*' -and $_.Message -like '*entering the stopped state*' }

if ($events) {
    Write-Host "[!] VSS Service stopped recently (check if related to shadow copy deletion)." -ForegroundColor Yellow
} else {
    Write-Host "[-] No recent VSS stop events found." -ForegroundColor Green
}