Analytics Story: Interlock Ransomware

Date: 2025-07-28 ID: 4aad8560-07cb-4114-97fc-66963da3a354 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Leverage searches that allow you to detect and investigate unusual activities associated with Interlock Ransomware, such as unexpected file encryption patterns, anomalous process execution (e.g., PowerShell or CMD spawning from Office applications), and large-scale file renaming. Look for indicators including creation of ransom notes (e.g., !README!.txt), high volumes of file modifications in short time spans, and suspicious outbound connections to command-and-control infrastructure. Correlate these behaviors with privilege escalation attempts, scheduled tasks or registry changes, and endpoint detections tied to known Interlock payloads. Implement behavioral analytics and MITRE ATT&CK mappings (e.g., T1486 - Data Encrypted for Impact) to surface early signs of ransomware activity before full encryption occurs.

Why it matters

The Interlock ransomware variant was first observed in late September 2024, targeting various business, critical infrastructure, and other organizations in North America and Europe. FBI maintains these actors target their victims based on opportunity, and their activity is financially motivated. FBI is aware of Interlock ransomware encryptors designed for both Windows and Linux operating systems; these encryptors have been observed encrypting virtual machines (VMs) across both operating systems. FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups. Actors were also observed using the ClickFix social engineering technique for initial access, in which victims are tricked into executing a malicious payload under the guise of fixing an issue on the victim’s system. Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Common Ransomware Extensions	Data Destruction	TTP
Common Ransomware Notes	Data Destruction	Hunting
Detect Remote Access Software Usage File	Remote Access Tools	Anomaly
Detect Remote Access Software Usage FileInfo	Remote Access Tools	Anomaly
Detect Remote Access Software Usage Process	Remote Access Tools	Anomaly
Disabled Kerberos Pre-Authentication Discovery With Get-ADUser	AS-REP Roasting	TTP
Disabled Kerberos Pre-Authentication Discovery With PowerView	AS-REP Roasting	TTP
Domain Account Discovery with Wmic	Domain Account	TTP
Enable RDP In Other Port Number	Remote Services	TTP
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
High Process Termination Frequency	Data Encrypted for Impact	Anomaly
Network Connection Discovery With Arp	System Network Connections Discovery	Hunting
PowerShell 4104 Hunting	PowerShell	Hunting
PowerShell Domain Enumeration	PowerShell	TTP
Ransomware Notes bulk creation	Data Encrypted for Impact	Anomaly
Registry Keys Used For Persistence	Registry Run Keys / Startup Folder	TTP
System Information Discovery Detection	System Information Discovery	TTP
Windows AD ServicePrincipalName Added To Domain Account	Account Manipulation	TTP
Windows AD Short Lived Domain Account ServicePrincipalName	Account Manipulation	TTP
Windows Boot or Logon Autostart Execution In Startup Folder	Registry Run Keys / Startup Folder	Anomaly
Windows High File Deletion Frequency	Data Destruction	Anomaly
Windows PowerShell FakeCAPTCHA Clipboard Execution	PowerShell, Malicious Link, Windows Command Shell	TTP
Windows PowerView SPN Discovery	Kerberoasting	TTP
Windows RDP Connection Successful	RDP Hijacking	Hunting
Windows RDP File Execution	Spearphishing Attachment, Remote Desktop Protocol	TTP
Windows Suspicious Driver Loaded Path	Windows Service	TTP
Windows Suspicious Process File Path	Create or Modify System Process, Match Legitimate Resource Name or Location	TTP
Cisco Secure Firewall - Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
Detect Remote Access Software Usage DNS	Remote Access Tools	Anomaly
Detect Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
TOR Traffic	Multi-hop Proxy	TTP
Windows Multi hop Proxy TOR Website Query	Mail Protocols	Anomaly
Detect Remote Access Software Usage URL	Remote Access Tools	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
Cisco Secure Firewall Threat Defense Connection Event	N/A	`cisco:sfw:estreamer`	`not_applicable`
CrowdStrike ProcessRollup2	N/A	`crowdstrike:events:sensor`	`crowdstrike`
Palo Alto Network Threat	Network	`pan:threat`	`pan:threat`
Palo Alto Network Traffic	Network	`pan:traffic`	`screenconnect_palo_traffic`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 23	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 26	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 5	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 6	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log RemoteConnectionManager 1149	Windows	`wineventlog`	`WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 5136	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a

Source: GitHub | Version: 1