Ransomware Batchfiles in the Belfry, Detections for Lockbit Black .bat Files
Following on from reading an unSafe.sh post about recent Lockbit ransomware gang activity, aka the new "Lockbit Black", I decided to look into a file that was posted along with the analysis, "123.bat".
You can view or grab a gist of the batch file below:
We're going to run this batch file on a test VM and have a look at the resulting logs for some detection ideas, I'll be giving examples in Splunk SPL but I am certain with a little SIEM magic you can adapt the content to elastic, Sentinel or Defender Advanced Hunting queries instead.
Lets get to it.
The first questions we have to ask though, are around log availability and log visibility.
Are you ingesting Windows EventID 4688 and command line parameters along with that? How about logs from Powershell? If you are still running an older version of Powershell in your estate and finding motivation to update to 5+ is tough then here's your driver, better security and better logs that you can bung into your SIEM for better detections.
Some of the detections here aren't going to be the most complex or elegant but we can also look at what the TAs in this case were looking to achieve with this batch file.
Also worth noting Defender on my test VM caught this batch file, pay attention to your AV/EDR alerts on batch files even if they are remediated, those scripts got on your box somehow.
Our first few lines revolve around the Windows Instrumentation command-line interface (WMIC) stopping Sophos AV both as a service and a running process.
I should add here I'm assuming that Sophos features heavily in this .bat because the TAs had already reconned the targeted enterprise estate and knew they were a Sophos shop.
Detections here would be around the name of your AV or EDR of choice appearing in a command line with wmic and process terminate or service delete.
Nestled in among the various Sophos specific commands is a command to uninstall "Microsoft Security Client" which is part of "Microsoft Security Essentials", basically Microsoft's legacy antivirus which was end of serviced by MS on January 14th, 2020 but still receives signature updates until next year.
We can catch a massive chunk of this kind of activity with some fairly simple SPL:
index=winlogs EventCode=4688 New_Process_Name=*\\WMIC.exe (Process_Command_Line=*
| stats min(_time) AS earliest max(_time) AS latest count(Process_Command_Line) AS Count values(Process_Command_Line) AS Process_Command_Line BY Creator_Process_Name New_Process_Name ComputerName Account_Name
| convert ctime(earliest) ctime(latest)
Our results, based around 123.bat execution, will look like this:
On lines 14 and 15 we have the TAs trying to stop Sophos AV again, this time via Powershell, in case wmic didn't cut it I suppose.
These events will look like this, through the lens of EventID 4688
If you want to know more about "stop-service" here's the Microsoft page. The parameter that stands out above is -force, which as MS describes it, "forces the cmdlet to stop a service even if that service has dependent services".
And we can capture this activity with some simple SPL again.
index=winlogs EventCode=4688 New_Process_Name=*\\
| stats min(_time) AS earliest max(_time) AS latest count(Process_Command_Line) AS Count values(Process_Command_Line) AS Process_Command_Line BY Creator_Process_Name New_Process_Name ComputerName Account_Name
| convert ctime(earliest) ctime(latest)
