{"id":"e3f673b3-65d1-4d80-9146-466f8b63fa99","title":"Suspicious Appended Extension","description":"Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as \".jpg.crypted\", \".docx.locky\", etc.","author":"frack113","status":"test","level":"medium","date":"2022-07-16","modified":"2023-11-11","tags":["attack.impact","attack.t1486"],"technique_ids":["T1486"],"logsource":{"product":"windows","category":"file_rename","definition":"Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword"},"falsepositives":["Backup software"],"references":["https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/","https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/"],"source_path":"rules/windows/file/file_rename/file_rename_win_ransomware.yml","source_sha256":"d06612763afae5d26eb7ead155b2c3ce03ae28e36061231c1c346c0c147e10a0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_rename/file_rename_win_ransomware.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Appended Extension\nid: e3f673b3-65d1-4d80-9146-466f8b63fa99\nstatus: test\ndescription: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as \".jpg.crypted\", \".docx.locky\", etc.\nreferences:\n    - https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/\n    - https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/\nauthor: frack113\ndate: 2022-07-16\nmodified: 2023-11-11\ntags:\n    - attack.impact\n    - attack.t1486\nlogsource:\n    product: windows\n    category: file_rename\n    definition: 'Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword'\ndetection:\n    selection:\n        SourceFilename|endswith:\n            - '.doc'\n            - '.docx'\n            - '.jpeg'\n            - '.jpg'\n            - '.lnk'\n            - '.pdf'\n            - '.png'\n            - '.pst'\n            - '.rtf'\n            - '.xls'\n            - '.xlsx'\n        TargetFilename|contains:\n            - '.doc.'\n            - '.docx.'\n            - '.jpeg.'\n            - '.jpg.'\n            - '.lnk.'\n            - '.pdf.'\n            - '.png.'\n            - '.pst.'\n            - '.rtf.'\n            - '.xls.'\n            - '.xlsx.'\n    filter_main_generic:\n        TargetFilename|endswith:\n            # Note: Please add more used extensions by backup or recovery software\n            - '.backup'\n            - '.bak'\n            - '.old'\n            - '.orig'\n            - '.temp'\n            - '.tmp'\n    filter_optional_anaconda:\n        TargetFilename|contains: ':\\ProgramData\\Anaconda3\\'\n        TargetFilename|endswith: '.c~'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Backup software\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1486","id":"T1486","name":"Data Encrypted for Impact","page":"techniques/enterprise/T1486/"}],"data_path":"data/detection-rules/e3f673b3-65d1-4d80-9146-466f8b63fa99.json","kind":"sigma"}