Ransomware hits healthcare - Robbinhood activity

Description

Find distinct evasion and execution activities. Associated with the Robbinhood ransomware campaign.

Query · kql

DeviceProcessEvents 
| where Timestamp > ago(7d) 
| where InitiatingProcessFileName =~ "winlogon.exe"  
| where FileName == "cmd.exe" and ProcessCommandLine has_any("taskkill", "net", 
"robbin", "vssadmin", "bcdedit", "wevtutil")
Raw source Ransomware hits healthcare - Robbinhood activity · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 61ca48de-5973-4f9d-8f9c-e24776b6ba45
name: Ransomware hits healthcare - Robbinhood activity
description: |
  Find distinct evasion and execution activities.
  Associated with the Robbinhood ransomware campaign.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d) 
  | where InitiatingProcessFileName =~ "winlogon.exe"  
  | where FileName == "cmd.exe" and ProcessCommandLine has_any("taskkill", "net", 
  "robbin", "vssadmin", "bcdedit", "wevtutil")

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.