Elastic medium stable eql

Potential AWS S3 Bucket Ransomware Note Uploaded

Identifies potential ransomware note being uploaded to an AWS S3 bucket. This rule detects the PutObject S3 API call with an object name commonly associated with ransomware notes. The keywords detected here rarely overlap with common file names and have been attributed to ransomware notes with high-confidence. Adversaries with access to a misconfigured S3 bucket may retrieve, delete, and replace objects with ransom notes to extort victims.

View Source

Detection Logic

file where
  data_stream.dataset == "aws.cloudtrail" and
  event.provider == "s3.amazonaws.com" and
  event.action == "PutObject" and
  event.outcome == "success" and
  /* Apply regex to match patterns only after the bucket name */
  /* common ransom note file name keywords */
  aws.cloudtrail.resources.arn regex~ "arn:aws:s3:::[^/]+/.*?(how
| decrypt
| restor
| help
| instruct
| read
| get
| recov
| save
| encrypt
| delet
| info
| ransom).*"
  and not aws.cloudtrail.resources.arn regex~ ".*(AWSLogs
| CloudTrail
| access-logs).*"
  and not aws.cloudtrail.user_identity.type == "AWSService"

False Positives

⚠ This rule uses matches regex patterns for common ransom note file names. Ensure that the uploaded file is not part of a legitimate operation before taking action.

Field Validations

Loading…

Comments (0)

Loading comments...