Trellix Source Code Breach: RansomHouse Intrusion — Detection and Hardening Guide

---
title: Potential Source Code Exfiltration via Archiving
id: 8f4a9b1c-6e2d-4f1a-9b3c-1d2e3f4a5b6c
status: experimental
description: Detects potential exfiltration of source code through the use of archiving tools like 7-Zip or WinRAR on directories containing source code indicators (.git, src, repo). This behavior is consistent with data theft groups like RansomHouse staging stolen intellectual property.
references:
  - https://www.bleepingcomputer.com/news/security/trellix-source-code-breach-claimed-by-ransomhouse-hackers/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.exfiltration
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_archiver:
    Image|endswith:
      - '\7z.exe'
      - '\winrar.exe'
      - '\zip.exe'
  selection_source_flags:
    CommandLine|contains:
      - '.git'
      - '\src\'
      - '\repo'
      - 'source'
  condition: all of selection_*
falsepositives:
  - Legitimate backups by developers
level: high
---
title: Trellix Agent Service Termination
id: 9e5b0c2d-7f3e-5g2h-0c4d-2e3f4a5b6c7d
status: experimental
description: Detects attempts to stop or disable Trellix Endpoint Security services. Following a source code leak, adversaries may leverage specific knowledge to bypass tamper protection. Unusual service termination is a high-fidelity indicator of potential defense evasion.
references:
  - https://www.bleepingcomputer.com/news/security/trellix-source-code-breach-claimed-by-ransomhouse-hackers/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains: 'stop'
  selection_trellix_service:
    CommandLine|contains:
      - 'mfepms'
      - 'macmnsvc'
      - 'mfeeps'
  condition: all of selection_*
falsepositives:
  - Authorized administrative maintenance
level: critical
---
title: RansomHouse Data Staging Tool - Rclone
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects execution of Rclone, a tool frequently used by RansomHouse and other extortion groups for large-scale data exfiltration to cloud storage. Its presence on a workstation or server is suspicious.
references:
  - https://www.bleepingcomputer.com/news/security/trellix-source-code-breach-claimed-by-ransomhouse-hackers/
author: Security Arsenal
date: 2024/05/21
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rclone.exe'
  condition: selection
falsepositives:
  - Authorized use by IT admins for backup
level: high

// Hunt for potential source code exfiltration patterns
let ArchiveProcesses = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("7z.exe", "winrar.exe", "zip.exe", "rclone.exe")
| project DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, Timestamp;
let NetworkEgress = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "ConnectionSuccess"
| where RemotePort in (443, 80) // Common cloud storage ports
| summarize TotalBytesSent = sum(SentBytes) by DeviceName, RemoteUrl, bin(Timestamp, 5m)
| where TotalBytesSent > 5000000 // 5MB threshold
| project DeviceName, RemoteUrl, TotalBytesSent, ExfilTimestamp=Timestamp;
ArchiveProcesses
| join NetworkEgress on DeviceName
| where Timestamp between ((ExfilTimestamp - 5m) .. (ExfilTimestamp + 5m))
| project DeviceName, AccountName, ProcessCommandLine, RemoteUrl, TotalBytesSent, Timestamp
| order by Timestamp desc

-- Hunt for RansomHouse indicators and Source Code access
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe,
  Username,
  CreateTime
FROM pslist()
WHERE Name =~ 'rclone' 
   OR Name =~ '7z' 
   OR Name =~ 'winrar'

UNION ALL

-- Check for recent .git folder access
SELECT 
  FullPath, 
  Size, 
  Mtime,
  Atime
FROM glob(globs='/*/.git/**')
WHERE Atime > now() - 7d
  AND NOT FullPath =~ '\\AppData\\'

# Trellix Security Post-Check and Hardening Script
# Run as Administrator

Write-Host "[+] Starting Trellix Security Audit..." -ForegroundColor Cyan

# 1. Check Trellix Service Status
Write-Host "[*] Checking Trellix Endpoint Security Services..." -ForegroundColor Yellow
$trellixServices = @("mfepms", "macmnsvc", "mfeeps")

foreach ($svc in $trellixServices) {
    $service = Get-Service -Name $svc -ErrorAction SilentlyContinue
    if ($service) {
        if ($service.Status -ne "Running") {
            Write-Host "[!] ALERT: Service $svc is not running. Current Status: $($service.Status)" -ForegroundColor Red
        } else {
            Write-Host "[+] Service $svc is running normally." -ForegroundColor Green
        }
    }
}

# 2. Scan for common archiving/exfiltration tools in user directories
Write-Host "[*] Scanning for unauthorized archiving tools (7zip, WinRAR, Rclone)..." -ForegroundColor Yellow
$pathsToScan = @("C:\Users\", "C:\ProgramData\")
$suspiciousFiles = @()

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        $results = Get-ChildItem -Path $path -Recurse -Include "7z.exe", "winrar.exe", "rclone.exe" -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime
        if ($results) {
            $suspiciousFiles += $results
        }
    }
}

if ($suspiciousFiles.Count -gt 0) {
    Write-Host "[!] Found suspicious executables:" -ForegroundColor Red
    $suspiciousFiles | Format-Table -AutoSize
} else {
    Write-Host "[+] No common archiving tools found in user paths." -ForegroundColor Green
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan