wadhrama-data-destruction

id: 08502f9f-7a04-4608-b5ad-5cfa129c073b
name: wadhrama-data-destruction
description: |
  This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama.
  The ransomware known as Wadhrama has been used in human-operated attacks that follow a particular pattern. The attackers often use Remote Desktop Protocol (RDP) to gain initial access to a device or network, exfiltrate credentials, and maintain persistance.
  The following query checks for possible Wadhrama-related activity, by detecting any use of Windows Management Instrumentation command-line utility, or WMIC, to delete local backups. The attackers often delete all local backups on an infected device before actually running the ransomware.
  Other techniques used by the group associated with Wadhrama are listed under See also.
  Reference - https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wadhrama
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Impact
query: |
  // Find use of WMIC to delete backups before ransomware execution
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where FileName =~ "wmic.exe"
  | where ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete"
  | project DeviceId, Timestamp, InitiatingProcessFileName, FileName,
  ProcessCommandLine, InitiatingProcessIntegrityLevel, InitiatingProcessParentFileName