Synology NAS Encryption Attacks: Detection and Remediation Guide for Outdated DSM Devices

---
title: Suspicious Process Execution on Synology NAS via Syslog
id: 3a8f1c92-7b4d-4e56-9c21-2d5e8f0a1b3c
status: experimental
description: Detects suspicious shell commands commonly associated with ransomware deployment on Synology NAS devices, including mass file operations, encryption tool execution, and shadow/snapshot deletion attempts.
references:
  - https://attack.mitre.org/techniques/T1486/
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/08
tags:
  - attack.impact
  - attack.t1486
  - attack.t1490
logsource:
  product: linux
  service: syslog
detection:
  selection_host:
    Host|contains:
      - 'synology'
      - 'diskstation'
      - 'rackstation'
      - 'NAS'
  selection_cmd:
    Message|contains:
      - 'openssl enc'
      - 'tar czf'
      - 'find / -name'
      - 'rm -rf /volume'
      - 'dd if=/dev/urandom'
      - 'chattr +i'
      - 'crontab -'
      - 'wget http'
      - 'curl -o /tmp'
      - 'chmod 777'
      - 'base64 -d'
      - 'python -c'
      - 'perl -e'
  condition: selection_host and selection_cmd
falsepositives:
  - Legitimate administrative scripts run by NAS administrators
  - Backup software performing scheduled operations
level: high
---
title: Mass File Modification on SMB Share Consistent with Ransomware
id: 7c2d4e81-3f6a-4b89-0d15-8e9c2a4f6b1d
status: experimental
description: Detects rapid file modification patterns on SMB shares consistent with ransomware encryption activity, including high volumes of file renames or writes to network storage.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/02/08
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\'
    Image|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  filter_known_extensions:
    TargetFilename|endswith:
      - '.tmp'
      - '.log'
      - '.etl'
  condition: selection and not filter_known_extensions
falsepositives:
  - Legitimate bulk file operations by users
  - Backup or sync software performing scheduled tasks
level: medium
---
title: Ransom Note Creation on Network Share
id: 1e5a9c34-8d2f-4b67-a3c8-6f1d4e7b0a29
status: experimental
description: Detects creation of known ransom note filenames on network shares, indicating active ransomware deployment targeting NAS-hosted data.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/02/08
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'HOW_TO_DECRYPT'
      - 'DECRYPT_INSTRUCTIONS'
      - 'README_FOR_DECRYPT'
      - 'HOW_TO_RECOVER'
      - 'RECOVER_FILES'
      - 'RESTORE_FILES'
      - 'DECRYPT_FILES'
      - 'YOUR_FILES_ARE_ENCRYPTED'
      - 'OPEN_THIS_TO_DECRYPT'
  condition: selection
falsepositives:
  - Security testing or tabletop exercises
  - Honeypot files intentionally placed for detection
level: critical

// Hunt 1: Suspicious process execution logged via Synology Syslog ingestion
// Requires: Synology NAS forwarding logs to Sentinel via Syslog/CEF connector
Syslog
| where TimeGenerated > ago(72h)
| where Computer contains "synology" or Computer contains "NAS" or Computer contains "diskstation"
| where SyslogMessage has_any (
    "openssl enc", "chmod 777", "rm -rf", "wget http", "curl -o",
    "base64 -d", "python -c", "perl -e", "crontab", "dd if=",
    "chattr", "tar czf"
)
| project TimeGenerated, Computer, Facility, SeverityLevel, SyslogMessage, ProcessName, ProcessID
| order by TimeGenerated desc;

// Hunt 2: High-volume file modifications on NAS-mapped drives (Defender for Endpoint)
// Detects ransomware-like encryption behavior against network shares
DeviceFileEvents
| where TimeGenerated > ago(24h)
| where FolderPath startswith "\\\\" // UNC paths to NAS
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| summarize FileOps = count(), UniqueExtensions = dcount(FileExtension), 
    Extensions = make_set(FileExtension, 20), 
    UniqueFiles = dcount(FileName)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(TimeGenerated, 5m)
| where FileOps > 100 // Threshold: >100 file ops in 5 minutes from a single process
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileOps, UniqueExtensions, Extensions
| order by FileOps desc;

// Hunt 3: Ransom note creation on network shares
DeviceFileEvents
| where TimeGenerated > ago(72h)
| where ActionType == "FileCreated"
| where FolderPath startswith "\\\\"
| where FileName has_any (
    "HOW_TO_DECRYPT", "DECRYPT_INSTRUCTIONS", "README_FOR_DECRYPT",
    "RECOVER_FILES", "RESTORE_FILES", "YOUR_FILES_ARE_ENCRYPTED"
)
| project TimeGenerated, DeviceName, FolderPath, FileName,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc;

// Hunt 4: Unusual authentication to Synology DSM web interface
CommonSecurityLog
| where TimeGenerated > ago(72h)
| where DeviceProduct contains "Synology" or DestinationHostName contains "synology" or DestinationHostName contains "NAS"
| where DestinationPort in (5000, 5001)
| where Activity contains "login" or Activity contains "auth"
| summarize LoginAttempts = count(), 
    UniqueSources = dcount(SourceIP),
    SourceIPs = make_set(SourceIP, 10)
    by DestinationHostName, bin(TimeGenerated, 1h)
| where LoginAttempts > 10 or UniqueSources > 3
| order by LoginAttempts desc;

-- Hunt for processes accessing NAS shares with ransomware-like behavior
-- Deploy as a hunt across endpoints that mount or access Synology NAS shares

LET nas_process_hunt = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(\\\\[0-9]{1,3}\\.|\\\\.*\\volume|net use|robocopy.*\\\\)'
   OR Exe =~ '(?i)(temp|tmp|appdata\\\\local\\\\temp|programdata)'
ORDER BY CreateTime DESC;

-- Check for recently created files matching ransom note patterns
LET ransom_note_hunt = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:\\*\\*DECRYPT*', accessor='ntfs')
WHERE Mtime > now() - 259200  // Last 72 hours
UNION
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:\\*\\*RECOVER*FILES*', accessor='ntfs')
WHERE Mtime > now() - 259200;

-- Combine results
SELECT * FROM nas_process_hunt
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, FullPath AS Name, NULL AS Exe,
       Size AS CommandLine, NULL AS Username, Mtime AS CreateTime
FROM ransom_note_hunt;

#!/bin/bash
# Synology NAS Security Audit and IoC Check
# Run via SSH as admin on Synology NAS devices
# Usage: bash synology_security_audit.sh

TIMESTAMP=$(date +%Y%m%d_%H%M%S)
REPORT="/tmp/nas_security_audit_${TIMESTAMP}.log"

echo "==========================================" | tee "$REPORT"
echo "Synology NAS Security Audit - ${TIMESTAMP}" | tee -a "$REPORT"
echo "==========================================" | tee -a "$REPORT"

# --- 1. DSM Version Check ---
echo -e "\n[1] DSM VERSION CHECK" | tee -a "$REPORT"
DSM_VERSION=$(cat /etc.defaults/VERSION 2>/dev/null || cat /etc/VERSION 2>/dev/null)
echo "Current DSM Version Info:" | tee -a "$REPORT"
echo "$DSM_VERSION" | tee -a "$REPORT"

echo -e "\nACTION REQUIRED: Compare against latest DSM version at:"
echo "https://www.synology.com/en-global/support/download"

# --- 2. Check for Unauthorized User Accounts ---
echo -e "\n[2] USER ACCOUNT AUDIT" | tee -a "$REPORT"
echo "Users with shell access:" | tee -a "$REPORT"
grep -E '/bin/(ba)?sh' /etc/passwd | tee -a "$REPORT"

echo -e "\nRecently modified accounts (last 30 days):" | tee -a "$REPORT"
find /etc -name "passwd" -mtime -30 -exec ls -la {} \; | tee -a "$REPORT"

# --- 3. Scheduled Tasks Audit ---
echo -e "\n[3] SCHEDULED TASKS / CRON AUDIT" | tee -a "$REPORT"
echo "System crontab:" | tee -a "$REPORT"
cat /etc/crontab 2>/dev/null | tee -a "$REPORT"

echo -e "\nCron directories:" | tee -a "$REPORT"
ls -laR /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.weekly/ /etc/cron.monthly/ 2>/dev/null | tee -a "$REPORT"

echo -e "\nUser crontabs:" | tee -a "$REPORT"
ls -la /var/spool/cron/ 2>/dev/null | tee -a "$REPORT"
for user_crontab in /var/spool/cron/*; do
    if [ -f "$user_crontab" ]; then
        echo "--- $user_crontab ---" | tee -a "$REPORT"
        cat "$user_crontab" | tee -a "$REPORT"
    fi
done

# --- 4. Check for Suspicious Processes ---
echo -e "\n[4] SUSPICIOUS PROCESS CHECK" | tee -a "$REPORT"
echo "Processes running from unusual locations:" | tee -a "$REPORT"
ps aux | grep -E '(/tmp/|/var/tmp/|/dev/shm/|\./)' | grep -v grep | tee -a "$REPORT"

echo -e "\nProcesses with high CPU (potential encryption activity):" | tee -a "$REPORT"
ps aux --sort=-%cpu | head -20 | tee -a "$REPORT"

# --- 5. Network Connections ---
echo -e "\n[5] NETWORK CONNECTION AUDIT" | tee -a "$REPORT"
echo "Established external connections:" | tee -a "$REPORT"
netstat -tnp 2>/dev/null | grep ESTABLISHED | grep -v '127.0.0.1\|::1' | tee -a "$REPORT"

echo -e "\nListening ports:" | tee -a "$REPORT"
netstat -tlnp 2>/dev/null | tee -a "$REPORT"

# --- 6. Recent File Modifications (Encryption Indicators) ---
echo -e "\n[6] RECENT FILE MODIFICATION CHECK" | tee -a "$REPORT"
echo "Files modified in last 24 hours on volumes (potential encryption):" | tee -a "$REPORT"
find /volume* -maxdepth 3 -mtime -1 -type f 2>/dev/null | head -100 | tee -a "$REPORT"

echo -e "\nSuspicious filenames (ransom notes):" | tee -a "$REPORT"
find /volume* -maxdepth 5 \( -iname "*decrypt*" -o -iname "*ransom*" -o -iname "*recover*file*" -o -iname "*restore*file*" -o -iname "*how_to*" \) -type f 2>/dev/null | tee -a "$REPORT"

# --- 7. Authentication Log Review ---
echo -e "\n[7] AUTHENTICATION LOG REVIEW" | tee -a "$REPORT"
echo "Recent failed SSH logins:" | tee -a "$REPORT"
grep -i "failed\|invalid" /var/log/auth.log 2>/dev/null | tail -50 | tee -a "$REPORT"

echo -e "\nRecent successful logins:" | tee -a "$REPORT"
grep -i "accepted\|session opened" /var/log/auth.log 2>/dev/null | tail -30 | tee -a "$REPORT"

# --- 8. Auto Block and Firewall Status ---
echo -e "\n[8] SECURITY CONFIGURATION CHECK" | tee -a "$REPORT"
echo "Firewall rules:" | tee -a "$REPORT"
iptables -L -n 2>/dev/null | head -50 | tee -a "$REPORT"

echo -e "\nSynology firewall status:" | tee -a "$REPORT"
cat /etc/sysconfig/network-scripts/ifcfg-* 2>/dev/null | tee -a "$REPORT"

# --- 9. Snapshot Integrity Check ---
echo -e "\n[9] SNAPSHOT INTEGRITY" | tee -a "$REPORT"
echo "BTRFS snapshots:" | tee -a "$REPORT"
btrfs subvolume list / 2>/dev/null | grep -i snap | tee -a "$REPORT"

echo -e "\n==========================================" | tee -a "$REPORT"
echo "Audit complete. Report saved to: $REPORT" | tee -a "$REPORT"
echo "==========================================" | tee -a "$REPORT"

echo -e "\nIMMEDIATE ACTIONS:"
echo "1. Update DSM to the latest version via Control Panel > Update & Restore"
echo "2. Disable any unnecessary services (SSH, Telnet, QuickConnect if not needed)"
echo "3. Enable firewall and restrict access to trusted IP ranges"
echo "4. Enable 2FA for all administrator accounts"
echo "5. Verify backup integrity on an isolated/offline copy"