---
title: KRYBIT Ransomware - Phishing Macro Execution with LOLBin Chain
id: 8a3f1c2e-7b4d-4e9a-b1c5-2d8f6a0e3b7d
status: experimental
description: Detects Office macro execution spawning suspicious child processes consistent with KRYBIT phishing-delivered loaders. Monitors for winword.exe or excel.exe spawning cmd, powershell, mshta, or rundll32 — a pattern observed in KRYBIT affiliate initial access.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1566/001/
  - https://attack.mitre.org/techniques/T1059/
date: 2026/11/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_known_paths:
    CommandLine|contains:
      - 'sophos'
      - 'crowdstrike'
      - 'sentinelone'
  condition: selection_parent and selection_child and not filter_known_paths
fields:
  - CommandLine
  - ParentCommandLine
  - User
  - Image
falsepositives:
  - Legitimate Office add-ins spawning processes (rare)
  - Automated document processing pipelines
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1059
  - krybit

---
title: KRYBIT Ransomware - Pre-Encryption Staging via PsExec and WMI Lateral Movement
id: 5c2d8e1a-9f3b-4a7c-b6d4-1e5f8a0c2b9e
status: experimental
description: Detects PsExec service creation and WMI remote process execution patterns consistent with KRYBIT affiliate lateral movement during the 4-14 day dwell window. Monitors for PSEXESVC service installation and WMI-spawned processes on remote systems.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1569/002/
  - https://attack.mitre.org/techniques/T1047/
  - https://attack.mitre.org/techniques/T1021/
date: 2026/11/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\psexesvc.exe'
    CommandLine|contains:
      - '-accepteula'
      - '-s '
      - '-d '
      - '-h '
  selection_wmi_remote:
    ParentImage|endswith:
      - '\WmiPrvSE.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\vssadmin.exe'
      - '\wbadmin.exe'
      - '\bcdedit.exe'
  selection_wmi_suspicious_cmd:
    ParentImage|endswith:
      - '\WmiPrvSE.exe'
    CommandLine|contains:
      - 'vssadmin delete'
      - 'wbadmin delete'
      - 'bcdedit'
      - 'wmic shadowcopy'
      - 'net stop'
      - 'taskkill'
      - 'cipher /w'
  condition: selection_psexec or (selection_wmi_remote and 1 of selection_wmi_suspicious_cmd*)
fields:
  - CommandLine
  - ParentCommandLine
  - ParentImage
  - User
  - Computer
falsepositives:
  - Legitimate administrative PsExec usage by IT teams
  - SCCM/MECM remote software deployment
  - Vulnerability scanners using WMI
level: critical
tags:
  - attack.lateral_movement
  - attack.t1569.002
  - attack.t1047
  - attack.t1021
  - attack.impact
  - attack.t1490
  - krybit

---
title: KRYBIT Ransomware - Data Staging and Exfiltration Before Encryption
id: 3f7a1b9d-6c2e-4d8a-b5f1-9e0c3a7d2b4f
status: experimental
description: Detects data staging and exfiltration behaviors consistent with KRYBIT double-extortion playbook. Monitors for 7-Zip/WinRAR compression of sensitive directories, Rclone execution, and mass file access patterns indicating collection for exfiltration.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1567/002/
  - https://attack.mitre.org/techniques/T1074/001/
date: 2026/11/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_archiving:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\7zg.exe'
      - '\rar.exe'
      - '\winrar.exe'
      - '\tar.exe'
    CommandLine|contains:
      - 'a -t'
      - 'a -mx'
      - 'a -v'
      - '-p'
  selection_rclone:
    Image|endswith:
      - '\rclone.exe'
      - '\rclone'
  selection_rclone_cmd:
    CommandLine|contains:
      - 'rclone'
      - '--config'
      - 'copy '
      - 'sync '
      - 'move '
      - 'mega'
      - 'dropbox'
      - 'gdrive'
      - 'sftp'
      - 'webdav'
      - 'b2'
      - 's3'
  selection_staging_paths:
    CommandLine|contains:
      - 'C:\ProgramData\'
      - 'C:\Users\Public\'
      - 'C:\Temp\'
      - 'C:\Windows\Temp\'
      - '\AppData\Local\Temp\'
  filter_av:
    CommandLine|contains:
      - 'crowdstrike'
      - 'sentinelone'
      - 'defender'
      - 'carbonblack'
  condition: (selection_archiving and selection_staging_paths) or (selection_rclone and selection_rclone_cmd) and not filter_av
fields:
  - CommandLine
  - Image
  - User
  - ParentImage
falsepositives:
  - IT backup operations using 7-Zip or RAR
  - Legitimate Rclone usage for cloud backup
  - Software packaging and deployment tools
level: critical
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1074.001
  - attack.exfiltration
  - attack.t1567.002
  - krybit

// KRYBIT Ransomware — Pre-Encryption Staging & Lateral Movement Hunt
// Microsoft Sentinel KQL Query
// Hunts for: PsExec/WMI lateral movement, shadow copy deletion, mass compression, and Cobalt Strike-style beacon patterns
// Recommended lookback: 14 days (matches KRYBIT observed dwell time window)
// Run in Microsoft Sentinel Logs or Advanced Hunting

let lookback = 14d;
let suspiciousProcesses = dynamic(["vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "wmic.exe", "psexec.exe", "psexesvc.exe", "rclone.exe", "7z.exe", "rar.exe", "winrar.exe", "certutil.exe", "bitsadmin.exe"]);
let suspiciousCmdPatterns = dynamic(["vssadmin delete", "shadowcopy delete", "wbadmin delete catalog", "bcdedit /set", "recoveryenabled no", "rclone copy", "rclone sync", "rclone move"]);

// Part 1: Detect shadow copy deletion and recovery inhibition (pre-encryption TTP)
let ShadowCopyDeletion =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("vssadmin.exe", "wbadmin.exe", "wmic.exe", "bcdedit.exe")
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "delete catalog", "recoveryenabled no", "bootstatuspolicy ignoreallfailures")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend AlertCategory = "ShadowCopyDeletion";

// Part 2: Detect PsExec-style remote service execution
let PsExecActivity =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName =~ "PSEXESVC.exe"
        or (InitiatingProcessFileName =~ "services.exe" and ProcessCommandLine has "PSEXESVC")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend AlertCategory = "PsExecExecution";

// Part 3: Detect WMI remote process creation with suspicious commands
let WMILateralMovement =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName =~ "WmiPrvSE.exe"
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe", "vssadmin.exe", "wmic.exe", "certutil.exe")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend AlertCategory = "WMIRemoteExecution";

// Part 4: Detect mass archiving (data staging for exfiltration)
let DataStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe")
    | where ProcessCommandLine has_any ("ProgramData", "Users\\Public", "Windows\\Temp", "AppData\\Local\\Temp")
        or ProcessCommandLine has_any (" -p", " -v", " -mx")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend AlertCategory = "DataStaging";

// Part 5: Detect Rclone execution (exfiltration tool)
let RcloneExfil =
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName =~ "rclone.exe" or ProcessCommandLine has "rclone"
    | where ProcessCommandLine has_any ("copy", "sync", "move", "mega", "dropbox", "gdrive", "sftp", "webdav", "s3")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend AlertCategory = "RcloneExfiltration";

// Part 6: Detect network beaconing patterns (Cobalt Strike-style)
let NetworkBeaconing =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemotePort in (80, 443, 8080, 8443, 4444, 5555, 4433, 8888)
    | where InitiatingProcessFileName in~ ("rundll32.exe", "regsvr32.exe", "powershell.exe", "dllhost.exe", "svchost.exe")
    | where RemoteIPType == "Public"
    | summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
    | where ConnectionCount > 50
    | extend TimeDelta = datetime_diff("minute", LastSeen, FirstSeen)
    | extend AvgIntervalSec = (TimeDelta * 60) / ConnectionCount
    | where AvgIntervalSec between (20 .. 120)  // 20-120 second beacon intervals typical of Cobalt Strike
    | extend AlertCategory = "BeaconingPattern";

// Union all detection categories
union
    ShadowCopyDeletion,
    PsExecActivity,
    WMILateralMovement,
    DataStaging,
    RcloneExfil
| sort by TimeGenerated desc
| project AlertCategory, TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;

// Run NetworkBeaconing separately for network-layer hunting:
// NetworkBeaconing
// | sort by ConnectionCount desc;

# ============================================================================
# KRYBIT Ransomware — Rapid Response Detection & Hardening Script
# Security Arsenal Threat Intelligence
# Run as Administrator on suspect systems or deploy via GPO/Intune/SCCM
# Purpose: Detect pre-encryption indicators and apply emergency hardening
# ============================================================================

Write-Host "=== KRYBIT Ransomware Rapid Response Script ===" -ForegroundColor Cyan
Write-Host "Date: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan
Write-Host "Hostname: $env:COMPUTERNAME" -ForegroundColor Cyan
Write-Host ""

$findings = @()
$lookback = (Get-Date).AddDays(-14)

# --- 1. Check for recently created scheduled tasks (persistence) ---
Write-Host "[1] Checking scheduled tasks created in last 14 days..." -ForegroundColor Yellow
try {
    $recentTasks = Get-ScheduledTask | Where-Object {
        $_.Date -gt $lookback -and
        $_.TaskPath -notlike "\Microsoft*"
    } | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}}

    if ($recentTasks) {
        Write-Host "  [!] SUSPICIOUS: $($recentTasks.Count) non-Microsoft scheduled tasks created in last 14 days:" -ForegroundColor Red
        $recentTasks | Format-Table -AutoSize | Out-String | Write-Host -ForegroundColor Red
        $findings += "Scheduled tasks: $($recentTasks.Count) recent non-Microsoft tasks found"
    } else {
        Write-Host "  [OK] No suspicious recent scheduled tasks" -ForegroundColor Green
    }
} catch {
    Write-Host "  [WARN] Could not enumerate scheduled tasks: $($_.Exception.Message)" -ForegroundColor DarkYellow
}

# --- 2. Check Volume Shadow Copy status ---
Write-Host "[2] Checking Volume Shadow Copy status..." -ForegroundColor Yellow
try {
    $shadows = Get-CimInstance -ClassName Win32_ShadowCopy -ErrorAction SilentlyContinue
    if ($shadows) {
        Write-Host "  [OK] $($shadows.Count) shadow copies exist" -ForegroundColor Green
        $shadows | Select-Object ID, InstallDate, VolumeName | Format-Table -AutoSize | Out-String | Write-Host
    } else {
        Write-Host "  [!] ALERT: No Volume Shadow Copies found — may have been deleted (pre-encryption TTP)" -ForegroundColor Red
        $findings += "VSS: No shadow copies exist on this system"
    }

    # Check VSS service status
    $vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
    if ($vssService.Status -ne "Running") {
        Write-Host "  [WARN] VSS service is $($vssService.Status) — should be at least Manual/Automatic" -ForegroundColor DarkYellow
    }
} catch {
    Write-Host "  [WARN] Could not check shadow copies: $($_.Exception.Message)" -ForegroundColor DarkYellow
}

# --- 3. Check for exposed RDP ---
Write-Host "[3] Checking RDP exposure..." -ForegroundColor Yellow
try {
    $rdpEnabled = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
    if ($rdpEnabled -eq 0) {
        Write-Host "  [!] RDP is ENABLED on this system" -ForegroundColor Red

        # Check if RDP is listening on non-standard port
        $rdpPort = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -ErrorAction SilentlyContinue).PortNumber
        Write-Host "      RDP Port: $rdpPort $(if($rdpPort -eq 3389){'(default — higher scan exposure)'}else{'(non-standard)'})" -ForegroundColor $(if($rdpPort -eq 3389){'Red'}else{'Yellow'})

        # Check NLA status
        $nla = (Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication
        if ($nla -eq 0) {
            Write-Host "      [!] NLA is DISABLED — RDP is vulnerable to brute force without pre-authentication" -ForegroundColor Red
            $findings += "RDP: Enabled on port $rdpPort with NLA disabled"
        } else {
            Write-Host "      [OK] NLA is enabled" -ForegroundColor Green
        }

        # Check for recent failed logons (brute force indicator)
        $failedLogons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=$lookback} -MaxEvents 50 -ErrorAction SilentlyContinue
        if ($failedLogons.Count -gt 20) {
            Write-Host "      [!] ALERT: $($failedLogons.Count) failed logon attempts in last 14 days (possible brute force)" -ForegroundColor Red
            $findings += "RDP: $($failedLogons.Count) failed logons in 14 days"
        }
    } else {
        Write-Host "  [OK] RDP is disabled" -ForegroundColor Green
    }
} catch {
    Write-Host "  [WARN] Could not check RDP status: $($_.Exception.Message)" -ForegroundColor DarkYellow
}

# --- 4. Check for suspicious processes (KRYBIT toolset) ---
Write-Host "[4] Checking for suspicious running processes..." -ForegroundColor Yellow
$suspiciousProcs = @("rclone", "psexesvc", "7z", "rar", "winrar", "megacmd", "mip22", "FileZilla")
$runningSuspicious = Get-Process | Where-Object { $proc = $_.ProcessName; $suspiciousProcs | Where-Object { $proc -like "*$_*" } }
if ($runningSuspicious) {
    Write-Host "  [!] SUSPICIOUS PROCESSES RUNNING:" -ForegroundColor Red
    $runningSuspicious | Select-Object ProcessName, Id, Path, StartTime | Format-Table -AutoSize | Out-String | Write-Host -ForegroundColor Red
    $findings += "Processes: $($runningSuspicious.Count) suspicious processes running"
} else {
    Write-Host "  [OK] No suspicious processes detected" -ForegroundColor Green
}

# --- 5. Check for recent mass file modifications (staging indicator) ---
Write-Host "[5] Checking for mass file modifications in temp/public directories..." -ForegroundColor Yellow
$stagingPaths = @("$env:TEMP", "C:\Users\Public", "C:\ProgramData", "C:\Windows\Temp")
foreach ($path in $stagingPaths) {
    if (Test-Path $path) {
        $recentFiles = Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt $lookback -and $_.Extension -match '\.(7z|rar|zip|tar|gz|bak|dump)$' }
        if ($recentFiles.Count -gt 0) {
            Write-Host "  [!] $($recentFiles.Count) archive files modified in $path in last 14 days:" -ForegroundColor Red
            $recentFiles | Select-Object FullName, LastWriteTime, @{N='SizeMB';E={[math]::Round($_.Length/1MB,2)}} | Format-Table -AutoSize | Out-String | Write-Host -ForegroundColor Red
            $findings += "Staging: $($recentFiles.Count) archives in $path"
        }
    }
}
if (-not ($findings | Where-Object { $_ -like "Staging*" })) {
    Write-Host "  [OK] No suspicious archive files found in staging directories" -ForegroundColor Green
}

# --- 6. Emergency hardening (optional — uncomment to apply) ---
Write-Host "[6] Emergency hardening options (currently report-only)" -ForegroundColor Yellow
Write-Host "  To apply hardening, re-run with -ApplyHardening switch" -ForegroundColor DarkYellow

<#
# UNCOMMENT TO APPLY HARDENING:

# Disable RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 1
Write-Host "  [APPLIED] RDP disabled" -ForegroundColor Green

# Enable NLA
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1
Write-Host "  [APPLIED] NLA enabled" -ForegroundColor Green

# Block PsExec via firewall
New-NetFirewallRule -DisplayName "Block PsExec Inbound" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block -ErrorAction SilentlyContinue
Write-Host "  [APPLIED] PsExec inbound SMB blocked" -ForegroundColor Green

# Enable VSS
vssadmin resize shadowstorage /for=C: /on=C: /maxsize=10%
Write-Host "  [APPLIED] VSS shadow storage configured" -ForegroundColor Green
#>

# --- Summary ---
Write-Host ""
Write-Host "=== SUMMARY ===" -ForegroundColor Cyan
if ($findings.Count -gt 0) {
    Write-Host "FINDINGS REQUIRING INVESTIGATION ($($findings.Count)):" -ForegroundColor Red
    $findings | ForEach-Object { Write-Host "  - $_" -ForegroundColor Red }
    Write-Host ""
    Write-Host "RECOMMENDATION: Isolate this system and initiate incident response procedures." -ForegroundColor Red
    Write-Host "Contact: security@securityarsenal.com for assistance." -ForegroundColor Cyan
} else {
    Write-Host "No immediate KRYBIT indicators detected." -ForegroundColor Green
    Write-Host "Continue monitoring and ensure KEV patches are applied." -ForegroundColor Green
}