PH_Rule_UEBA_TAG_18
Enabled
FortiSIEM UEBA Policy detects ransomware note
9
Security
UEBA
No Technique Specified
Application
Windows via FortiSIEM Agent with UEBA turned on
Correlation
No remediation guidance specified
If the following pattern or patterns match an ingested event within the given time window in seconds, trigger an incident.
600 seconds
If the following defined pattern/s occur within a 600 second time window.
UEBA
This is the named definition of the event query, this is important if multiple subpatterns are defined to distinguish them.
This is the query logic that matches incoming events
eventType CONTAIN "FINS-Windows-" AND fileName IN ("!! return files !!.txt", "!!! how to decrypt files !!!.txt", "!!! read this - important !!!.txt", "!!!!!save your files!!!!.txt", "!!!!restore_files!!!.txt", "!!!-warning-!!!.html", "!!!-warning-!!!.txt", "!!!getbackdata!!!.txt", "!!!read_it!!!.txt", "!!!read_to_unlock!!!.txt", "!!!readmetodecrypt.txt", "!!!save your files!.bmp", "!## decrypt files ##!.txt", "!#_decrypt_#!.inf", "!#_how_to_decrypt_files_#!", "!#_how_to_decrypt_files_$!.txt", "!=how_to_decrypt_files=!.txt", "!_!email__ prusa@goat.si __!..payman", "!____________deskrypt@tutamail.com________.rar", "!_how_recovery_files_!.txt", "!_recovery_help_!.txt", "!back_files!.html", "!gblock_info.rtf", "!ooopsyourfileslocked!.rtf", "!pedant_info!.rtf", "!please read me!.txt", "!read.htm", "!readme_gman!.rtf", "!readme_grhan!.rtf", "!satana!.txt", "!sblock_info!.rtf", "!wannadecryptor!.exe.lnk", "!where_are_my_files!.html", "# decrypt my files #.html", "# decrypt my files #.txt", "# decrypt my files #.vbs", "# how to decrypt files.txt", "# readme.hta", "###-read-for-hellpp.html", "#_#whatwrongwithmyfiles#_#.rtf", "#_decrypt_assistance_#.txt", "#_restoring_files_#.txt", "#help-decrypt-fcrypt1.1#.txt", "#how_decrypt_files#.html", "#how_to_unrip#.txt", "#newrar_readme#.rtf", "#readme_gman#.rtf", "#recovery_files#.txt", "$%%! note about files -=!-.html", "---readme---.txt", ".[decryptor@cock.li].dcrtr", "000-if-you-want-dec-files.html", "000-no-problem-we-dec-files.html", "000-please-read-we-help.html", "0000-sorry-for-files.html", "00000000.eky", "00000000.pky", "00000000.res", "001-read-for-decrypt-files.html", "005-do-you-want-files.html", "009-read-for-decccc-filesss.html", "0_help_decrypt_files.htm", "131181494299235.bat", "170fb7438316.exe", "176641494574290.bat", "217201494590800.bat", "4-14-2016-infection.txt", "52036f92.tmp", "@decrypt_your_files.txt", "@please_read_me@.txt", "@wanadecryptor@.exe", "@wanadecryptor@.exe.lnk", "[amanda_sofost@india.com].wallet", "\"!ymayka-email@yahoo.com.cryptotes\"", "_adatok_visszaallitasahoz_utasitasok.txt", "_crypt", "_decrypt_info_szesnl.html", "_help_instruction.txt", "_help_instructions.bmp", "_help_instructions.txt", "_help_recover_files_.html", "_how_recover.txt", "_how_to_decrypt.bmp", "_howdo_text.html", "_interesting_informacion_for_decrypt.txt", "_iwashere.txt", "_locky_recover_instructions.bmp", "_locky_recover_instructions.txt", "_read_me_for_decrypt.txt", "_readme_.hta", "_recover_instructions.ini", "_ryp", "_secret_code.txt", "_what_is.html", "_xiaoba_info_.hta", "aari.jpg", "about_files.txt", "aescrypt.exe", "allcry_upx.exe", "anatova.exe", "anatova.txt", "assistance_in_recovery.txt", "atlas_files.txt", "attention!!!.txt", "attention.url", "bahij2@india.com", "bitcryptorfilelist.txt", "blooper.exe", "btc_decrypt_files.txt", "buyunlockcode", "buyunlockcode.txt", "callofcthulhu.exe", "clopreadme.txt", "coin.locker.txt", "como descriptografar seus arquivos.txt", "como_abrir_arquivos.txt", "como_restaurar_archivos.html", "como_restaurar_archivos.txt", "confirmation.key", "crjoker.html", "cryptinfo.txt", "cryptoransomware.exe", "crytp0l0cker.dll", "crytp0l0cker.exe", "crytp0l0cker.upack.dll", "cscc.dat", "cversions.2.db", "cyber splitter vbs.exe", "dale_files.txt", "de_crypt_readme.bmp", "de_crypt_readme.html", "de_crypt_readme.txt", "decoding help.hta", "decrypt explanations.html", "decrypt_info.txt", "decrypt_information.html", "decrypt_instruction.html", "decrypt_instruction.txt", "decrypt_instruction.url", "decrypt_instructions.html", "decrypt_instructions.txt", "decrypt_readme.txt", "decrypt_readme.txt.readme", "decrypt_readme1.txt", "decrypt_your_files.html", "decrypt_your_files.txt", "decryptallfiles.txt", "decrypted_files.dat", "decryptfile.txt", "decryption instructions.txt", "decryption.txt", "decryption_howto.notepad", "decypt_your_files.html", "default32643264.bmp", "default432643264.jpg", "desifrovani_pokyny.html", "desktoposiris.htm", "dispci.exe", "dllhost.dat", "ebay-msg.html", "ebay_was_here", "enc_files.txt", "encryptor_raas_readme_liesmich.txt", "enigma.hta", "enigma_encr.txt", "entschlusseln_hinweise.html", "exit.hhr.obleep", "fe04.tmp", "file decrypt help.html", "file0locked.js", "file_encryption_notice.txt", "files encrypted.html", "files encrypted.txt", "files.txt", "files_back.txt", "filesaregone.txt", "filesinfo.txt", "firstransomware.exe", "galaperidol.exe", "getyoufiles.txt", "gjenoppretting_av_filer.html", "gjenoppretting_av_filer.txt", "hacked_read_me_to_decrypt_files.html", "hello there! fellow @kee user!.txt", "hellothere.txt", "help decrypt.html", "help-file-decrypt.enc", "help-me-enced-files.html", "help_decrypt.html", "help_decrypt.lnk", "help_decrypt.png", "help_decrypt.txt", "help_decrypt.url", "help_decrypt_your_files.html", "help_me_please.txt", "help_recover_files.txt", "help_restore_files.txt", "help_to_decrypt.txt", "help_to_decrypt_your_files.txt", "help_to_save_files.bmp", "help_to_save_files.txt", "help_your_files.html", "help_your_files.png", "help_your_files.txt", "help_yourfiles.html", "helpdecrypt.txt", "helpdecyprt_your_files.html", "how decript files.hta", "how decrypt files.hta", "how decrypt my files.lnk", "how to decode files.hta", "how to decrypt aes files.lnk", "how to decrypt files.html", "how to decrypt files.txt", "how to decrypt lechiffre files.html", "how to decrypt your data.txt", "how to decrypt your files.jpg", "how to decrypt your files.txt", "how to decrypt.txt", "how to decrypt[1t0to].txt", "how to get back you files.txt", "how to get data back.txt", "how to get data.txt", "how to recover encrypted files-infovip@airmail.cc.txt", "how to recover encrypted files.txt", "how to restore files.hta", "how to restore files.txt", "how-to-decrypt-files.html", "how-to-restore-files.txt", "how_can_i_decrypt_my_files.txt", "how_decrypt.gif", "how_decrypt.html", "how_decrypt.txt", "how_decrypt.url", "how_decrypt_files#.html", "how_decrypt_files.hta", "how_decrypt_my_files", "how_open_files.hta", "how_return_files.txt", "how_to_back_files.html", "how_to_decrypt.html", "how_to_decrypt_files.html", "how_to_decrypt_files.txt", "how_to_decrypt_my_files.txt", "how_to_decrypt_your_files.jpg", "how_to_fix_!.txt", "how_to_recover_files.txt", "how_to_recver_files.txt", "how_to_restore_files.hta", "how_to_restore_files.html", "how_to_restore_files.txt", "how_to_restore_your_data.html", "howdecrypt.gif", "howdecrypt.txt", "howto_recover_file.txt", "howto_restore_files.html", "howto_restore_files.txt", "howtodecryptaesfiles.txt", "howtodecryptimportant!.txt", "howtorestore_files.txt", "hur_dekryptera_filer.html", "hur_dekryptera_filer.txt", "hvordan_du_gendanner_filer.html", "hvordan_du_gendanner_filer.txt", "hwid lock.exe", "iamreadytopay.txt", "if you want to get all your files back, please read this.txt", "if_want_files_back_pls_read.html", "if_you_want_to_get_all_your_files_back_please_read_this.txt", "ihaveyoursecret.key", "important read me.txt", "important!.txt", "important.readme", "important_read_me.txt", "info.hta", "infpub.dat", "install_tor.url", "instrucciones.txt", "instrucciones_descifrado.html", "instrucciones_descifrado.txt", "instruction for file recovery.txt", "instruction restore file.txt", "instruction_for_helping_file_recovery.txt", "instructionaga.txt", "instructions_de_decryptage.html", "instructions_xxxx.png", "istruzioni_decrittazione.html", "kryptolocker_readme.txt", "last_chance.txt", "lblbitcoininfomain.txt", "lblfinallytext.txt", "lblmain.txt", "leer_inmediatamente.txt", "leia_me.txt", "locked.bmp", "lukitus.html", "matrix-readme.rtf", "maxcrypt.bmp", "mensagem.txt", "merry_i_love_you_bruce.hta", "message.txt", "mood-ravishing-hd-wallpaper-142943312215.jpg", "note;!!!-odzyskaj-pliki-!!!.txt", "oksowathappendtoyourfiles.txt", "oku.txt", "okubeni.txt", "ontsleutelings_instructies.html", "ownertrust.txt", "padcrypt.exe", "padcryptuninstaller.exe", "paxynok.html", "paycrypt.bmp", "payment-instructions.txt", "payment_advice.mht", "payment_instructions.jpg", "perfect.sys", "petwrap.exe", "please read me!.txt", "please-readit-if_you-want.html", "popcorn_time.exe", "pronk.txt", "qeriuwjhrf", "qwer.html", "qwer2.html", "qwerty-pub.key", "rans0m_n0te_read_me.txt", "ransom.rtf", "ransomed.html", "read if you want your files back.html", "read me (how decrypt) !!!!.txt", "read me about decryption.txt", "read me for decrypt.txt", "read me for help thanks.txt", "read-read-read.html", "read.txt", "read@my.txt", "read__it.txt", "read_decrypt_files.txt", "read_it.txt", "read_it_for_get_your_file.txt", "read_me.html", "read_me_!.txt", "read_me_asap.txt", "read_me_help.png", "read_me_help.txt", "read_me_to_decrypt_you_informa.jjj", "read_this_file.txt", "read_this_file_1.txt", "read_this_to_decrypt.html", "read_to_decrypt.html", "readdecryptfileshere.txt", "readme how to decrypt your files.html", "readme!!!.txt", "readme-matrix.rtf", "readme.hta", "readme_decryptor.txt", "readme_for_decrypt.txt", "readme_how_to_unlock.html", "readme_how_to_unlock.txt", "readme_important.txt", "readme_liesmich_encryptor_raas.txt", "readme_restore_files.txt", "readme_to_recure_your_files.txt", "readthisnow!!!.txt", "receipt.exe", "recover-files.html", "recover.bmp", "recover.txt", "recovery_file.txt", "recovery_files.txt", "recovery_key.txt", "recupere seus arquivos aqui.txt", "redchip2.exe", "restore files.txt", "restore-.-files.txt", "restore-12345-files.txt", "restore_corupted_files.html", "restore_files.html", "restore_files.txt", "restore_icpicp_files.txt", "restore_maysomware_files.html", "restore_your_files.txt", "restorefiles.txt", "rtext.txt", "runsome.exe", "screenlocker_x86.dll", "secret.key", "secretidhere.key", "security-issue-info.txt", "shtodelatvam.txt", "sifre_coz_talimat.html", "sifre_cozme_talimati.html", "sintalocker.exe", "sintarun.py", "spreader_x86.dll", "ssexecutor_x86.exe", "strongcrypt.bmp", "struttergear.exe", "survey locker.exe", "svchosd.exe", "t.wry", "taskdl.exe", "taskhsvc.exe", "tasksche.exe", "taskse.exe", "tempimage.jpg", "thxforyurtyme.txt", "tor.exe", "totallylegit.exe", "tox.html", "trumphead.exe", "try-read-me-to-dec.html", "tutoriel.bmp", "unblockfiles.vbs", "unlock_files_instructions.html", "unlock_files_instructions.txt", "uselessdisk.exe", "vape launcher.exe", "vault.hta", "vault.key", "vault.txt", "vip72.exe", "wannacry.exe", "wannacry.txt", "wannacrypt 4.0.exe", "wcry.exe", "wcry.zip", "we-must-dec-files.html", "what happen to my files.txt", "whathappenedwithfiles.rtf", "whathappenedwithmyfiles.rtf", "where-your-files.html", "wie_zum_wiederherstellen_von_dateien.txt", "winclwp.jpg", "windowsapplication1.exe", "xort.txt", "you_must_read_me.rtf", "yougothacked.txt", "your files are locked !!!!.txt", "your files are locked !!!.txt", "your files are locked !!.txt", "your files are locked !.txt", "your files are now encrypted.txt", "your files encrypted by our friends !!! txt", "your files encrypted by our friends !!!.txt", "your_files.html", "your_files.url", "your_files_are_dead.hta", "your_files_are_encrypted.html", "your_files_are_encrypted.txt", "your_files_are_locked.txt", "your_key.rsa", "yourid.txt", "zcrypt.exe", "zenis-instructions.html", "zino_note.txt", "zxz.html", "zzzzzzzzzzzzzzzzzyyy") AND user NOT REGEXP ".*\$$|dwn-.*|dwm-.*|umfd-.*|.*SYSTEM.*|.*ANONYMOUS.*"
This defines how matching events are aggregated, only events with the same matching attribute values are grouped into one unique incident ID
hostName,domain,user,procName,activityName
This is most typically a numerical constraint that defines when the rule should trigger an incident
COUNT(*) >= 1
This section defines which fields in matching raw events should be mapped to the incident attributes in the resulting incident.
The available raw event attributes to map are limited to the group by attributes and the aggregate event constraint fields for each subpattern
hostName = UEBA.hostName,
domain = UEBA.domain,
user = UEBA.user,
procName = UEBA.procName,
activityName = UEBA.activityName