robbinhood-evasion

id: 75f492b5-b4ab-446e-8a9f-0607fbee2baa
name: robbinhood-evasion
description: |
  This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
  Robbinhood is ransomware that has been involved in several high-profile incidents, including a 2019 attack on the city of Baltimore, Maryland. Robbinhood operators often employ a distinctive defense evasion technique, where they load a vulnerable driver on to a target and exploit it, in order to turn off security software -- essentially using the driver as malware.
  The following query detects a late stage of this technique, when the operator is issuing commands to turn off the driver.
  For a query that detects an earlier stage of this technique, see Detect loading of vulnerable drivers by Robbinhood ransomware campaign.
  References:
  https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
  https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Robinhood.A&ThreatID=2147735370
  https://www.nytimes.com/2019/05/22/us/baltimore-ransomware.html
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Defense evasion
query: |
  // RobbinHood execution and security evasion
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where InitiatingProcessFileName =~ "winlogon.exe"
  | where FileName == "cmd.exe" and ProcessCommandLine has_any("taskkill", "net",
  "robbin", "vssadmin", "bcdedit", "wevtutil")