blue-team-tools/rules/windows/process_creation/proc_creation_win_malware_notpetya.yml

title: NotPetya Ransomware Activity
id: 79aeeb41-8156-4fac-a0cd-076495ab82a1
status: test
description: Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and windows eventlogs are cleared using wevtutil
author: Florian Roth, Tom Ueltschi
references:
  - https://securelist.com/schroedingers-petya/78870/
  - https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100
date: 2019/01/16
modified: 2022/03/05
logsource:
  category: process_creation
  product: windows
detection:
  select_pipe_com:
    CommandLine|contains|all:
      - '\AppData\Local\Temp\'
      - '\\\\.\\pipe\\'
  select_rundll32_dash1:
    Image|endswith: '\rundll32.exe'
    CommandLine|endswith: 
      - '.dat,#1'
      - '.dat #1' # Sysmon removes comma
  select_perfc_keyword:
    - '\perfc.dat'
  condition: 1 of select*
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Admin activity
level: critical
tags:
  - attack.defense_evasion
  - attack.t1218.011
  - attack.t1070.001
  - attack.credential_access
  - attack.t1003.001
  - car.2016-04-002