Threat Hunt: Detecting Excessive File Writes/Modifications with Ransomware Note Extensions

March 6, 2024

The query filters for file creation or modification events, specifically looking for files with extensions commonly used in ransomware notes. It then…..

Oops! It looks like the content you're trying to access is exclusively available to our amazing Patreon supporters. Your support fuels our website and helps us keep our automation humming. Not only will you unlock a world of exclusive content starting from just $1/£1, but you'll also help keep our site running smoothly. Some of our content is tier-specific, ensuring our patrons get the value they deserve for their support. Join us today and be part of our thriving community!

To view this content, you must be a member of RedPacketSecurity's Patreon

Unlock with Patreon

Already a qualifying Patreon member? Refresh to access this content.

Threat Hunt: Detecting Excessive File Writes/Modifications with Ransomware Note Extensions

[HUNTERS] – Ransomware Victim: Amourgis & Associates

[HUNTERS] – Ransomware Victim: Dietzgen Corporation

Cobalt Strike Beacon Detected – 156[.]238[.]227[.]43:80

Cobalt Strike Beacon Detected – 8[.]134[.]166[.]14:443

Cobalt Strike Beacon Detected – 123[.]57[.]209[.]214:1234

You may have missed

[HUNTERS] – Ransomware Victim: Amourgis & Associates

[HUNTERS] – Ransomware Victim: Dietzgen Corporation

Cobalt Strike Beacon Detected – 156[.]238[.]227[.]43:80

Cobalt Strike Beacon Detected – 8[.]134[.]166[.]14:443

Cobalt Strike Beacon Detected – 123[.]57[.]209[.]214:1234