Ransomware Attack on Good Samaritan Health Center: Defending Healthcare PHI from Encryption-Based Incidents

---
title: Potential Ransomware Activity - Volume Shadow Copy Deletion via VssAdmin
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects attempts to delete Volume Shadow Copies using vssadmin.exe, a common precursor to ransomware encryption to prevent file recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains: 'delete shadows'
  condition: selection
falsepositives:
  - Legitimate administration by IT staff (rare)
level: high
---
title: Potential Ransomware Activity - Mass File Extension Modification
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects rapid renaming of files with a new extension, a heuristic for mass encryption events.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2024/05/22
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|contains: "."
  filter:
    TargetFilename|endswith:
      - ".tmp"
      - ".log"
  timeframe: 1m
  condition: selection | count() > 50 and not filter
falsepositives:
  - Bulk file processing by legitimate backup software
level: critical

// Hunt for Ransomware Precursors: Shadow Copy Deletion and Suspicious PowerShell
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows") 
   or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Invoke-AESEncryption", "IEX", "DownloadString") and ProcessCommandLine has "-enc")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for Ransomware Notes and Suspicious Encrypted Files
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/*")
WHERE FullPath =~ '(?i)_readme\.txt$'
   OR FullPath =~ '(?i)decrypt.*\.(html|txt|png)$'
   OR FullPath =~ '(?i)RECOVER.*\.(txt|html)$'
   OR FullPath =~ '\.locked$' OR FullPath =~ '\.encrypted$'
LIMIT 100

# Ransomware Incident Response - Artifact Hunter
Write-Host "[*] Starting Ransomware Artifact Hunt..." -ForegroundColor Cyan

# 1. Check for VSS Writer Status
Write-Host "[+] Checking Volume Shadow Copy Service Status..." -ForegroundColor Yellow
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vssService) {
    Write-Host "    VSS Service Status: $($vssService.Status)"
} else {
    Write-Host "    [!] VSS Service not found." -ForegroundColor Red
}

# 2. Hunt for Common Ransom Note Extensions in User Profiles
Write-Host "[+] Searching for common ransom note file extensions..." -ForegroundColor Yellow
$paths = @("C:\Users\", "C:\ProgramData\")
$extensions = @("*.txt", "*.html", "*.png")
$keywords = @("readme", "decrypt", "recover", "restore", "files", "how_to", "instruction")

$foundNotes = @()
foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Include $extensions -ErrorAction SilentlyContinue | ForEach-Object {
            if ($_.Name -match "(?i)($($keywords -join '|'))") {
                $foundNotes += $_.FullName
            }
        }
    }
}

if ($foundNotes.Count -gt 0) {
    Write-Host "    [!] Potential Ransom Notes Found:" -ForegroundColor Red
    $foundNotes | ForEach-Object { Write-Host "        - $_" }
} else {
    Write-Host "    No obvious ransom notes found." -ForegroundColor Green
}

# 3. Check for encrypted file patterns (simple heuristics)
Write-Host "[+] Checking for mass encrypted files (e.g., .locked, .encrypted)..." -ForegroundColor Yellow
$encExtensions = @("*.locked", "*.encrypted", "*.micro", "*.crypt", "*.cryptowall")
$foundEncrypted = @()
Get-ChildItem -Path "C:\Users\" -Recurse -Include $encExtensions -ErrorAction SilentlyContinue | ForEach-Object {
    $foundEncrypted += $_.FullName
}

if ($foundEncrypted.Count -gt 0) {
    Write-Host "    [!] Found potential encrypted files. Limiting output to first 10:" -ForegroundColor Red
    $foundEncrypted | Select-Object -First 10 | ForEach-Object { Write-Host "        - $_" }
} else {
    Write-Host "    No files with common encrypted extensions found." -ForegroundColor Green
}