SophosLabs has published the IOC for Kaseya ransomware. Below is the query that fetches the IOC published on GitHub and check for matching Indicators present in the endpoint.
Fullscreen
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
/* EDR Query to check for matching REvil-Kaseya-IOC's */
--VARIABLE $$StartTime$$ DATE
--VARIABLE $$EndTime$$ DATE
WITH IOC_LIST (IOC_Type, Indicator, note) AS (
WITH IOC_FILE(Line, str) AS (
SELECT 'ip,127.0.0.1,TEST DATA', (SELECT result from curl where url = 'https://raw.githubusercontent.com/sophoslabs/IoCs/master/Ransomware-REvil-Kaseya.csv') ||char(10)
UNION ALL
SELECT substr(str, 0, instr(str, char(10) )), substr(str, instr(str, char(10) )+1) FROM IOC_FILE WHERE str!=''
)
SELECT
replace(Line, ltrim(Line, replace(Line, ',', '')), '') 'Indicator Type',
replace(replace(substr(Line, instr(Line, ',')+1), ltrim(substr(Line, instr(Line, ',')+1), replace(substr(Line, instr(Line, ',')+1), ',', '')), ''),'*','%') Indicator,
replace(Line, rtrim(Line, replace(Line, ',', '')), '') 'Note'
FROM
IOC_FILE
WHERE
Line != '' AND Line != 'Indicator type,Data,Note' AND Line NOT LIKE 'Description%' AND Line NOT LIKE '%TEST DATA%' AND Line NOT LIKE '%indicator_type%'
)
Sophos has published an article to know more about this attack,
You can find the IOC published by SophosLabs here
https://raw.githubusercontent.com/sophoslabs/IoCs/master/Ransomware-REvil-Kaseya.csv
