Regla para detectar Ransom.Satana

Hunt Hypothesis

This detection rule identifies adversary behavior associated with the Ransom.Satana ransomware family by monitoring for its specific execution patterns and file system modifications within the Azure Sentinel environment. A proactive hunt is essential to validate early-stage indicators of compromise before encryption begins, ensuring that low-severity alerts are not overlooked during the critical initial phases of an attack.

YARA Rule

rule Ransom_Satana
{
    meta:
        description = "Regla para detectar Ransom.Satana"
        author = "CCN-CERT"
        version = "1.0"
    strings:
        $a = { 21 00 73 00 61 00 74 00 61 00 6E 00 61 00 21 00 2E 00 74 00 78 00 74 00 00 }
        $b = { 74 67 77 79 75 67 77 71 }
        $c = { 53 77 76 77 6E 67 75 }
        $d = { 45 6E 75 6D 4C 6F 63 61 6C 52 65 73 }
        $e = { 57 4E 65 74 4F 70 65 6E 45 6E 75 6D 57 00 }
        $f = { 21 53 41 54 41 4E 41 21 }
    condition:
        $b or $c and $d and $a and $e and $f
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Ransom.Satana detection rule in an enterprise environment, including suggested filters and exclusions:

• Enterprise Backup Agent Execution

  • Scenario: The backup software (e.g., Veeam Backup & Replication, Commvault, or Rubrik) initiates a scheduled job that performs massive file enumeration and encryption of local snapshots. This activity mimics ransomware behavior by rapidly accessing and modifying thousands of files with high I/O throughput, potentially triggering the “massive file modification” logic of Ransom.Satana.
  • Filter/Exclusion: Create an exclusion for the specific process names (e.g., VeeamAgent.exe, commsvc.exe) running under the dedicated backup service account (e.g., DOMAIN\svc_backup). Additionally, exclude file paths located within known backup staging directories (e.g., C:\BackupStaging or D:\Snapshots).

• Windows Update and Patch Deployment

  • Scenario: During a maintenance window, the WSUS server or Microsoft Endpoint Configuration Manager (MECM/SCCM) pushes critical security patches. The installation process involves downloading large update packages, extracting them to temporary folders (C:\Windows\SoftwareDistribution), and replacing system DLLs in System32. This rapid sequence of file creation, modification, and permission changes can be misidentified as the initial encryption phase of a ransomware attack.
  • Filter/Exclusion: Exclude events generated by the TrustedInstaller.exe process or SCCM agents (ccmexec.exe). Apply a time-based filter to suppress alerts during known maintenance windows (e.g., Sundays 02:00–06:00 UTC) where patching is scheduled.

• Antivirus Real-Time Scanning and Quarantine *