FalconForce unknown stable kql

Inhibit system recovery

Attackers often delete backups prior to deploying ransomware in order to maximize their chances of getting the ransom paid. Since the organization doesn't have any backups anymore, it's significantly more likely that they will pay in order to retrieve their files. This is a classic definition of this technique "Inhibit system recovery".

View Source

Detection Logic

AzureActivity
// make sure to do the regex case insensitive, as the casing for the operation is different :( 
// also make sure to test this rule on a regular basis to ensure it keeps working even if Microsoft at some
// point decided to change the name of the operation.
| where OperationName matches regex "(?i)Put ((file)
| (blob)) service properties"
| where ResourceGroup =~ "<YOUR RG NAME HERE>"
| where ActivityStatus != "Started" // leave out the start. We want to get one hit only for the final result being "Succeeded" or "Failed" or whatever else.

Field Validations

Loading…

Comments (0)

Loading comments...