Ransomware hits healthcare - Turning off System Restore

Description

Find attempts to stop System Restore and. Prevent the system from creating restore points.

Query · kql

DeviceProcessEvents  
| where Timestamp > ago(7d)  
// Pivoting for rundll32  
and InitiatingProcessFileName =~ 'rundll32.exe'   
// Looking for empty command line   
and isnotempty(InitiatingProcessCommandLine)  
// Looking for schtasks.exe as the created process  
and FileName in~ ('schtasks.exe')  
// Disabling system restore   
and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore' 
and ProcessCommandLine has 'disable'
Raw source Ransomware hits healthcare - Turning off System Restore · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c6387bdd-c0ee-4b88-bbc2-3897586ecdda
name: Ransomware hits healthcare - Turning off System Restore
description: |
  Find attempts to stop System Restore and.
  Prevent the system from creating restore points.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents  
  | where Timestamp > ago(7d)  
  // Pivoting for rundll32  
  and InitiatingProcessFileName =~ 'rundll32.exe'   
  // Looking for empty command line   
  and isnotempty(InitiatingProcessCommandLine)  
  // Looking for schtasks.exe as the created process  
  and FileName in~ ('schtasks.exe')  
  // Disabling system restore   
  and ProcessCommandLine has 'Change' and ProcessCommandLine has 'SystemRestore' 
  and ProcessCommandLine has 'disable'

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.