Analytics Story: Interlock Ransomware

Updated Date: 2026-05-13 ID: 4aad8560-07cb-4114-97fc-66963da3a354 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Leverage searches that allow you to detect and investigate unusual activities associated with Interlock Ransomware, such as unexpected file encryption patterns, anomalous process execution (e.g., PowerShell or CMD spawning from Office applications), and large-scale file renaming. Look for indicators including creation of ransom notes (e.g., !README!.txt), high volumes of file modifications in short time spans, and suspicious outbound connections to command-and-control infrastructure. Correlate these behaviors with privilege escalation attempts, scheduled tasks or registry changes, and endpoint detections tied to known Interlock payloads. Implement behavioral analytics and MITRE ATT&CK mappings (e.g., T1486 - Data Encrypted for Impact) to surface early signs of ransomware activity before full encryption occurs.

Why it matters

The Interlock ransomware variant was first observed in late September 2024, targeting various business, critical infrastructure, and other organizations in North America and Europe. FBI maintains these actors target their victims based on opportunity, and their activity is financially motivated. FBI is aware of Interlock ransomware encryptors designed for both Windows and Linux operating systems; these encryptors have been observed encrypting virtual machines (VMs) across both operating systems. FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups. Actors were also observed using the ClickFix social engineering technique for initial access, in which victims are tricked into executing a malicious payload under the guise of fixing an issue on the victim’s system. Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
PowerShell Domain Enumeration	PowerShell	Anomaly
Ransomware Notes bulk creation	Data Encrypted for Impact	Anomaly
PowerShell 4104 Hunting	PowerShell	Hunting
Windows Boot or Logon Autostart Execution In Startup Folder	Registry Run Keys / Startup Folder	Anomaly
Detect Remote Access Software Usage FileInfo	Remote Access Tools	Anomaly
Detect Remote Access Software Usage URL	Remote Access Tools	Anomaly
Detect Remote Access Software Usage File	Remote Access Tools	Anomaly
System Information Discovery Detection	System Information Discovery	TTP
Common Ransomware Notes	Data Destruction	Hunting
Windows RDP Connection Successful	RDP Hijacking	Hunting
Common Ransomware Extensions	Data Destruction	TTP
Detect Remote Access Software Usage Process	Remote Access Tools	Anomaly
Windows AD ServicePrincipalName Added To Domain Account	Account Manipulation	TTP
Windows RMM Named Pipe	SMB/Windows Admin Shares, Process Injection, Inter-Process Communication	Anomaly
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Disabled Kerberos Pre-Authentication Discovery With PowerView	AS-REP Roasting	TTP
Enable RDP In Other Port Number	Remote Services	TTP
Windows AD Short Lived Domain Account ServicePrincipalName	Account Manipulation	TTP
TOR Traffic	Multi-hop Proxy	TTP
Registry Keys Used For Persistence	Registry Run Keys / Startup Folder	TTP
Windows High File Deletion Frequency	Data Destruction	Anomaly
Disabled Kerberos Pre-Authentication Discovery With Get-ADUser	AS-REP Roasting	TTP
Windows PowerShell FakeCAPTCHA Clipboard Execution	PowerShell, Windows Command Shell, Malicious Link	TTP
Windows PowerView SPN Discovery	Kerberoasting	TTP
Detect Remote Access Software Usage DNS	Remote Access Tools	Anomaly
Windows Multi hop Proxy TOR Website Query	Mail Protocols	Anomaly
Network Connection Discovery With Arp	System Network Connections Discovery	Hunting
Windows Suspicious Driver Loaded Path	Windows Service	TTP
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
High Process Termination Frequency	Data Encrypted for Impact	Anomaly
Detect Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
Windows RDP File Execution	Remote Desktop Protocol, Spearphishing Attachment	TTP
Domain Account Discovery with Wmic	Domain Account	TTP
Cisco Secure Firewall - Remote Access Software Usage Traffic	Remote Access Tools	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Palo Alto Network Threat	Network	`pan:threat`	`not_applicable`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Windows Event Log RemoteConnectionManager 1149	Windows	`wineventlog`	`WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational`
Windows Event Log Security 5136	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Palo Alto Network Traffic	Network	`pan:traffic`	`not_applicable`
Cisco Secure Firewall Threat Defense Connection Event	Other	`cisco:sfw:estreamer`	`not_applicable`
Sysmon EventID 26	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 23	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 6	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 5	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a

Source: GitHub | Version: 2