doppelpaymer-psexec

id: 82ab54b5-6387-4d84-b04f-165115272fae
name: doppelpaymer-psexec
description: |
  This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.
  DoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization. More specifically, they use common remote execution tools, such as PsExec, to move laterally and distribute ransomware.
  The following query detects suspicious usage of PsExec to create files on a remote device.
  The See also section below lists links to other queries associated with DoppelPaymer.
  References:
  https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/
  https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372
  https://docs.microsoft.com/sysinternals/downloads/psexec
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Lateral movement
query: |
  // PsExec creating files on remote machines
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where InitiatingProcessFileName startswith "psexe"
  | summarize CommandCount = dcount(ProcessCommandLine), makeset(ProcessCommandLine),
  makeset(FileName) by DeviceId, bin(Timestamp, 1d)
  | where CommandCount > 2
  | where set_ProcessCommandLine has "copy"