Rhysida Ransomware: Cookeville Medical Center Breach Detection and Containment

---
title: Rhysida Ransomware - CriticalBreach.htm Note Creation
id: 9c1e8f7d-a2b4-4c8d-9e1f-3a5b6c7d8e9f
status: experimental
description: Detects the creation of the specific HTML ransom note used by Rhysida ransomware, indicating active encryption operations.
references:
  - https://www.infosecurity-magazine.com/news/cookeville-medical-center-data/
author: Security Arsenal
date: 2025/10/22
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_creation
  product: windows
detection:
  selection:
    TargetFilename|contains: '\CriticalBreach.htm'
  condition: selection
falsepositives:
  - Unlikely (Filename is specific to the threat actor)
level: critical
---
title: Rhysida Ransomware - File Extension Encryption
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects rapid file renaming or creation of files with the .rhysida extension, a signature of the Rhysida encryption process.
references:
  - https://www.infosecurity-magazine.com/news/cookeville-medical-center-data/
author: Security Arsenal
date: 2025/10/22
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|endswith: '.rhysida'
  condition: selection
falsepositives:
  - Rare, potential false positive if legitimate software uses this extension
level: high

// Hunt for Rhysida Ransom Notes and Encrypted Files
// Look for the creation of the specific ransom note
DeviceFileEvents
| where FolderPath endswith @"\CriticalBreach.htm" or FileName == "CriticalBreach.htm"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, ActionType
| union (
    DeviceFileEvents
    // Look for mass file renames to .rhysida extension
    | where FileName endswith ".rhysida"
    | summarize count() by DeviceName, bin(Timestamp, 1m)
    | where count_ > 10 // Heuristic for mass encryption
    | join kind=inner (DeviceFileEvents | where FileName endswith ".rhysida") on DeviceName, Timestamp
    | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FileName
)
| order by Timestamp desc

-- Hunt for Rhysida Ransom Note and Encrypted Artifacts
SELECT 
    OSPath, 
    Mtime, 
    Atime, 
    Size, 
    Mode 
FROM glob(globs="*/CriticalBreach.htm")
UNION
SELECT 
    OSPath, 
    Mtime, 
    Size 
FROM glob(globs="*/*.rhysida")
LIMIT 100

<#
.SYNOPSIS
    Rhysida Ransomware Indicator Hunter
.DESCRIPTION
    Scans drives for 'CriticalBreach.htm' and files ending in .rhysida to assess impact.
#>

Write-Host "[+] Starting Rhysida Indicator Scan..." -ForegroundColor Cyan

$RansomNoteCount = 0
$EncryptedFileCount = 0
$Report = @()

# Scan for Ransom Notes
Write-Host "[*] Scanning for CriticalBreach.htm..." -ForegroundColor Yellow
$Notes = Get-ChildItem -Path C:\ -Recurse -Filter "CriticalBreach.htm" -ErrorAction SilentlyContinue
foreach ($Note in $Notes) {
    $RansomNoteCount++
    $Report += [PSCustomObject]@{
        Type      = "RansomNote"
        Path      = $Note.FullName
        Size      = "{0:N2} KB" -f ($Note.Length / 1KB)
        Timestamp = $Note.LastWriteTime
    }
}

# Scan for Encrypted Files (Limit to first 100 found per drive for speed)
Write-Host "[*] Sampling for .rhysida encrypted files..." -ForegroundColor Yellow
$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root
foreach ($Drive in $Drives) {
    $Files = Get-ChildItem -Path $Drive -Recurse -Filter "*.rhysida" -ErrorAction SilentlyContinue | Select-Object -First 100
    foreach ($File in $Files) {
        $EncryptedFileCount++
        $Report += [PSCustomObject]@{
            Type      = "EncryptedFile"
            Path      = $File.FullName
            Size      = "{0:N2} KB" -f ($File.Length / 1KB)
            Timestamp = $File.LastWriteTime
        }
    }
}

# Output Results
Write-Host "\n[+] Scan Complete." -ForegroundColor Green
Write-Host "    Ransom Notes Found: $RansomNoteCount" -ForegroundColor Red
Write-Host "    Encrypted Files Found (Sampled): $EncryptedFileCount" -ForegroundColor Red

if ($Report.Count -gt 0) {
    $OutputPath = "$env:TEMP\Rhysida_Scan_$(Get-Date -Format 'yyyyMMddHHmmss').csv"
    $Report | Export-Csv -Path $OutputPath -NoTypeInformation
    Write-Host "[+] Report saved to: $OutputPath" -ForegroundColor Cyan
} else {
    Write-Host "[!] No Rhysida indicators found." -ForegroundColor Green
}