Ransomware hits healthcare - Alternate Data Streams use

Description

Find use of Alternate Data Streams (ADS) for anti-forensic purposes. Alternate Data Streams execution.

Query · kql

DeviceProcessEvents 
| where Timestamp > ago(7d) 
// Command lines used 
| where ProcessCommandLine startswith "-q -s" and ProcessCommandLine has "-p" 
// Removing IDE processes 
and not(FolderPath has_any("visual studio", "ide")) 
| summarize make_set(ProcessCommandLine), make_set(FolderPath), 
make_set(InitiatingProcessCommandLine) by DeviceId, bin(Timestamp, 1h)
Raw source Ransomware hits healthcare - Alternate Data Streams use · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 90985951-5998-45d3-831f-8fd3c66ac9f9
name: Ransomware hits healthcare - Alternate Data Streams use
description: |
  Find use of Alternate Data Streams (ADS) for anti-forensic purposes.
  Alternate Data Streams execution.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d) 
  // Command lines used 
  | where ProcessCommandLine startswith "-q -s" and ProcessCommandLine has "-p" 
  // Removing IDE processes 
  and not(FolderPath has_any("visual studio", "ide")) 
  | summarize make_set(ProcessCommandLine), make_set(FolderPath), 
  make_set(InitiatingProcessCommandLine) by DeviceId, bin(Timestamp, 1h)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.