title: DIT Snapshot Viewer Use
id: d3b70aad-097e-409c-9df2-450f80dc476b
status: test
description: Detects the use of Ditsnap tool. Seems to be a tool for ransomware groups.
author: 'Furkan Caliskan (@caliskanfurkan_)'
references:
  - https://thedfirreport.com/2020/06/21/snatch-ransomware/
  - https://github.com/yosqueoy/ditsnap
date: 2020/07/04
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\ditsnap.exe'
  selection2:
    CommandLine|contains:
      - 'ditsnap.exe'
  condition: selection or selection2
falsepositives:
  - Legitimate admin usage
level: high
tags:
  - attack.credential_access
  - attack.t1003.003