wadhrama-credential-dump

Description

This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama. The ransomware known as Wadhrama has been used in human-operated attacks that follow a particular pattern. The attackers often use Remote Desktop Protocol (RDP) to gain initial access to a device or network, exfiltrate credentials, and maintain persistance. The following query checks for possible Wadhrama-related activity, by detecting the technique these attackers have used in the past to dump credentials. Other techniques used by the group associated with Wadhrama are listed under See also. Reference - https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wadhrama

Query · kql

// Find use of Image File Execution Options (IFEO) in conjunction
// with a .bat file to dump credentials
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has "sethc" or RegistryKey has "utilman"
Raw source wadhrama-credential-dump · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 8348d279-c95f-4dbe-b952-65048dc06559
name: wadhrama-credential-dump
description: |
  This query was originally published in the threat analytics report, RDP ransomware persists as Wadhrama.
  The ransomware known as Wadhrama has been used in human-operated attacks that follow a particular pattern. The attackers often use Remote Desktop Protocol (RDP) to gain initial access to a device or network, exfiltrate credentials, and maintain persistance.
  The following query checks for possible Wadhrama-related activity, by detecting the technique these attackers have used in the past to dump credentials.
  Other techniques used by the group associated with Wadhrama are listed under See also.
  Reference - https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Wadhrama
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
tactics:
- Credential Access
- Impact
query: |
  // Find use of Image File Execution Options (IFEO) in conjunction
  // with a .bat file to dump credentials
  DeviceRegistryEvents
  | where Timestamp > ago(7d)
  | where RegistryKey has "sethc" or RegistryKey has "utilman"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.