GitHub Repo

Analytics Story: Rhysida Ransomware

Updated Date: 2026-05-13 ID: 0925ee49-1185-4484-94ac-7867764a9183 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Utilize analytics designed to identify and delve into atypical behaviors, potentially associated with the Rhysida Ransomware. Employing these searches enables the detection of irregular patterns or actions within systems or networks, serving as proactive measures to spot potential indicators of compromise or ongoing threats. By implementing these search strategies, security analysts can effectively pinpoint anomalous activities, such as unusual file modifications, deviations in system behavior, that could potentially signify the presence or attempt of Rhysida Ransomware infiltration. These searches serve as pivotal tools in the arsenal against such threats, aiding in swift detection, investigation, and mitigation efforts to counter the impact of the Rhysida Ransomware or similar malicious entities.

Why it matters

This story addresses Rhysida ransomware. Rhysida Ransomware emerges as a silent predator, infiltrating systems stealthily and unleashing havoc upon its victims. Employing sophisticated encryption tactics, it swiftly locks critical files and databases, holding them hostage behind an impenetrable digital veil. The haunting demand for ransom sends shockwaves through affected organizations, rendering operations inert and plunging them into a tumultuous struggle between compliance and resilience. Threat actors leveraging Rhysida ransomware are known to impact "targets of opportunity," including victims in the education, healthcare, manufacturing, information technology, and government sectors. Open source reporting details similarities between Vice Society activity and the actors observed deploying Rhysida ransomware. Additionally, open source reporting has confirmed observed instances of Rhysida actors operating in a ransomware-as-a-service (RaaS) capacity, where ransomware tools and infrastructure are leased out in a profit-sharing model. Any ransoms paid are then split between the group and the affiliates.

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
CMD Carry Out String Command Parameter Windows Command Shell Hunting
Modification Of Wallpaper Defacement TTP
Executables Or Script Creation In Temp Path Masquerading Anomaly
Ransomware Notes bulk creation Data Encrypted for Impact Anomaly
NLTest Domain Trust Discovery Domain Trust Discovery TTP
Windows Modify Registry NoChangingWallPaper Modify Registry TTP
Domain Controller Discovery with Nltest Remote System Discovery TTP
Detect Rare Executables User Execution Anomaly
Windows PowerView Kerberos Service Ticket Request Kerberoasting TTP
Detect Zerologon via Zeek Exploit Public-Facing Application TTP
Windows Rundll32 Apply User Settings Changes Rundll32 Anomaly
Executables Or Script Creation In Suspicious Path Masquerading Anomaly
Detect Renamed PSExec Service Execution Hunting
Windows PowerView Unconstrained Delegation Discovery Remote System Discovery TTP
Windows PUA Named Pipe SMB/Windows Admin Shares, Process Injection, Inter-Process Communication Anomaly
Detect PsExec With accepteula Flag SMB/Windows Admin Shares TTP
Windows Suspicious Process File Path Match Legitimate Resource Name or Location, Create or Modify System Process TTP
Common Ransomware Notes Data Destruction Hunting
Windows Sensitive Group Discovery With Net Domain Groups Anomaly
Windows PowerView Constrained Delegation Discovery Remote System Discovery TTP
PowerShell 4104 Hunting PowerShell Hunting
WinRM Spawning a Process Exploit Public-Facing Application TTP
Deleting Shadow Copies Inhibit System Recovery TTP
Disable Logs Using WevtUtil Clear Windows Event Logs TTP
Windows Excessive Usage Of Net App Account Access Removal Anomaly
Spike in File Writes None Anomaly
Common Ransomware Extensions Data Destruction TTP
SAM Database File Access Attempt Security Account Manager Hunting
Scheduled Task Deleted Or Created via CMD Scheduled Task Anomaly
Ntdsutil Export NTDS NTDS TTP
Malicious Powershell Executed As A Service Service Execution TTP
Suspicious wevtutil Usage Clear Windows Event Logs TTP
System User Discovery With Whoami System Owner/User Discovery Hunting
High Process Termination Frequency Data Encrypted for Impact Anomaly
Windows Eventlog Cleared Via Wevtutil Clear Windows Event Logs Anomaly
Windows PowerView SPN Discovery Kerberoasting TTP
Windows Cmdline Tool Execution From Non-Shell Process JavaScript Anomaly
SecretDumps Offline NTDS Dumping Tool NTDS TTP
Windows Group Discovery Via Net Local Groups, Domain Groups Hunting
Windows PowerView AD Access Control List Enumeration Permission Groups Discovery, Domain Accounts TTP

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
Windows Event Log Security 4688 Windows icon Windows XmlWinEventLog XmlWinEventLog:Security
Sysmon EventID 1 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
CrowdStrike ProcessRollup2 Other crowdstrike:events:sensor crowdstrike
Sysmon EventID 13 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 11 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Powershell Script Block Logging 4104 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
Sysmon EventID 18 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 17 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Windows Event Log Security 4663 Windows icon Windows XmlWinEventLog XmlWinEventLog:Security
Windows Event Log System 7045 Windows icon Windows XmlWinEventLog XmlWinEventLog:System
Sysmon EventID 5 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

References

Source: GitHub | Version: 2