Winscp rule from Akira Ransomware report by frack113 · Pull Request #4939 · SigmaHQ/sigma

frack113 · 2024-07-30T17:19:15Z

Summary of the Pull Request

Winscp rule from https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry

Winscp can be use with "-" or "/" 😄

Changelog

new: FTP Connection Open Attempt Via Winscp CLI
new: Winscp Execution From Non Standard Folder

Example Log Event

<EventData>
  <Data>Sigma rule match found: Winscp CLI Command To Open Connexion (see Details tab for more information)</Data> 
  <Data>Module: Sigma</Data> 
  <Data>Rule_Title: Winscp CLI Command To Open Connexion</Data> 
  <Data>Rule_Author: frack113</Data> 
  <Data>Rule_Description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities</Data> 
  <Data>Rule_FalsePositives: undef</Data> 
  <Data>Rule_Id: c1477deb-37cf-4439-9ffb-44499acb89d0</Data> 
  <Data>Rule_Level: medium</Data> 
  <Data>Rule_Modified: 2024/07/30</Data> 
  <Data>Rule_Path: sigma-rules\proc_creation_win_winscp.yml</Data> 
  <Data>Rule_References: https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry</Data> 
  <Data>Rule_Sigtype: custom</Data> 
  <Data>CommandLine: "C:\Program Files (x86)\WinSCP\WinSCP.exe" /console=6.3.4 /consoleinstance=_12092_931 "/command" "open sftp://datadatauser@127.0.0.1:37654"</Data> 
  <Data>Company: Martin Prikryl</Data> 
  <Data>Computer: Win11</Data> 
  <Data>Correlation_ActivityID: {00000000-0000-0000-0000-000000000000}</Data> 
  <Data>Description: WinSCP: SFTP, FTP, WebDAV, S3 and SCP client</Data> 
  <Data>DirectoryTableBase: 0xE0E6000</Data> 
  <Data>EventID: 1</Data> 
  <Data>Execution_ProcessID: 12092</Data> 
  <Data>Execution_ThreadID: 6352</Data> 
  <Data>ExitStatus: 259</Data> 
  <Data>FileAge: 00d00h40m52s</Data> 
  <Data>FileCreationDate: 2024-07-30T17:38:58</Data> 
  <Data>FileVersion: 6.3.4.14955</Data> 
  <Data>Flags: 2</Data> 
  <Data>GrandparentCommandLine: "C:\Windows\System32\cmd.exe"</Data> 
  <Data>GrandparentImage: C:\Windows\System32\cmd.exe</Data> 
  <Data>GrandparentProcessId: 8112</Data> 
  <Data>Hashes: MD5=262797240A3056FB82E8299E23CB651E,SHA1=C1F271E5CED7A5BADF62042AB882584E45AEAB37,SHA256=47204338F0E092057024C9186F228C02417E917777F3E841D52B58251A956A74,IMPHASH=FB2CFDF855B58AFCE6D00A81ADADCD74</Data> 
  <Data>Image: C:\Program Files (x86)\WinSCP\WinSCP.exe</Data> 
  <Data>ImageFileName: WinSCP.exe</Data> 
  <Data>IntegrityLevel: Low</Data> 
  <Data>Keywords: 0x0</Data> 
  <Data>Level: 0</Data> 
  <Data>Match_Strings: /command in CommandLine, 'open ' in CommandLine, \WinSCP.exe in Image, winscp.exe in OriginalFileName</Data> 
  <Data>Opcode: 1</Data> 
  <Data>OriginalFileName: winscp.exe</Data> 
  <Data>ParentCommandLine: winscp.com /command "open sftp://datadatauser@127.0.0.1:37654"</Data> 
  <Data>ParentId: 0x2F3C</Data> 
  <Data>ParentImage: C:\Program Files (x86)\WinSCP\WinSCP.com</Data> 
  <Data>ParentProcessId: 12092</Data> 
  <Data>ParentUser: LAB\frack113</Data> 
  <Data>ProcessId: 1772</Data> 
  <Data>ProcessTree: C:\Windows\explorer.exe|C:\Windows\System32\cmd.exe|C:\Program Files (x86)\WinSCP\WinSCP.com|C:\Program Files (x86)\WinSCP\WinSCP.exe</Data> 
  <Data>Product: WinSCP</Data> 
  <Data>Provider_Guid: {3D6FA8D0-FE05-11D0-9DDA-00C04FD7BA7C}</Data> 
  <Data>Provider_Name: SystemTraceProvider-Process</Data> 
  <Data>SessionId: 1</Data> 
  <Data>Task: 0</Data> 
  <Data>TimeCreated_SystemTime: 2024-07-30T18:19:50.2126857+02:00</Data> 
  <Data>Timestamp: 2024-06-17T14:00:02</Data> 
  <Data>UniqueProcessKey: 0xFFFFB804CBA53100</Data> 
  <Data>User: LAB\frack113</Data> 
  <Data>UserSID: \\LAB\frack113</Data> 
  <Data>UtcTime: 2024-07-30 16:19:50</Data> 
  <Data>Version: 4</Data> 
  <Data>Winversion: 22631</Data> 
  </EventData>

<EventData>
 <Data>Sigma rule match found: Winscp Launch From Uncommon Folder (see Details tab for more information)</Data> 
 <Data>Module: Sigma</Data> 
 <Data>Rule_Title: Winscp Launch From Uncommon Folder</Data> 
 <Data>Rule_Author: frack113</Data> 
 <Data>Rule_Description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities</Data> 
 <Data>Rule_FalsePositives: undef</Data> 
 <Data>Rule_Id: 7674f8ef-7141-4cf0-a311-ee359264c64c</Data> 
 <Data>Rule_Level: medium</Data> 
 <Data>Rule_Modified: 2024/07/30</Data> 
 <Data>Rule_Path: sigma-rules\proc_creation_win_winscp_portable.yml</Data> 
 <Data>Rule_References: https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry</Data> 
 <Data>Rule_Sigtype: custom</Data> 
 <Data>Company: Martin Prikryl</Data> 
 <Data>Computer: Win11</Data> 
 <Data>Correlation_ActivityID: {00000000-0000-0000-0000-000000000000}</Data> 
 <Data>CreateTime: 2024-07-30T16:53:33.839038500Z</Data> 
 <Data>Description: WinSCP: SFTP, FTP, WebDAV, S3 and SCP client</Data> 
 <Data>EventID: 1</Data> 
 <Data>Execution_ProcessID: 6472</Data> 
 <Data>Execution_ThreadID: 13664</Data> 
 <Data>FileAge: 00d00h00m07s</Data> 
 <Data>FileCreationDate: 2024-07-30T18:47:55</Data> 
 <Data>FileVersion: 6.3.4.14955</Data> 
 <Data>Flags: 0</Data> 
 <Data>Hashes: MD5=262797240A3056FB82E8299E23CB651E,SHA1=C1F271E5CED7A5BADF62042AB882584E45AEAB37,SHA256=47204338F0E092057024C9186F228C02417E917777F3E841D52B58251A956A74,IMPHASH=FB2CFDF855B58AFCE6D00A81ADADCD74</Data> 
 <Data>Image: C:\Tests\WinSCP\WinSCP.exe</Data> 
 <Data>ImageChecksum: 0x15F9620</Data> 
 <Data>ImageFileName: WinSCP.exe</Data> 
 <Data>ImageName: \Device\HarddiskVolume3\Tests\WinSCP\WinSCP.exe</Data> 
 <Data>IntegrityLevel: Low</Data> 
 <Data>Keywords: 0x8000000000000010</Data> 
 <Data>Level: 4</Data> 
 <Data>MandatoryLabel: S-1-16-8192</Data> 
 <Data>Match_Strings: \WinSCP.exe in Image, winscp.exe in OriginalFileName</Data> 
 <Data>Opcode: 1</Data> 
 <Data>OriginalFileName: winscp.exe</Data> 
 <Data>ParentCommandLine: C:\WINDOWS\Explorer.EXE</Data> 
 <Data>ParentImage: C:\Windows\explorer.exe</Data> 
 <Data>ParentProcessId: 6472</Data> 
 <Data>ParentProcessSequenceNumber: 166</Data> 
 <Data>ParentSpoofed: yes</Data> 
 <Data>ParentUser: LAB\frack113</Data> 
 <Data>ProcessId: 7152</Data> 
 <Data>ProcessSequenceNumber: 1955</Data> 
 <Data>ProcessTokenElevationType: 1</Data> 
 <Data>ProcessTokenIsElevated: 0</Data> 
 <Data>ProcessTree: C:\Windows\explorer.exe|C:\Tests\WinSCP\WinSCP.exe</Data> 
 <Data>Product: WinSCP</Data> 
 <Data>Provider_Guid: {22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}</Data> 
 <Data>Provider_Name: Microsoft-Windows-Kernel-Process</Data> 
 <Data>Security_UserID: S-1-5-21-888117185-644776935-3477416708-1103</Data> 
 <Data>SessionID: 1</Data> 
 <Data>Task: 1</Data> 
 <Data>TimeCreated_SystemTime: 2024-07-30T18:53:33.900066+02:00</Data> 
 <Data>TimeDateStamp: 0x66702542</Data> 
 <Data>Timestamp: 2024-06-17T14:00:02</Data> 
 <Data>User: LAB\frack113</Data> 
 <Data>UtcTime: 2024-07-30 16:53:33</Data> 
 <Data>Version: 3</Data> 
 <Data>Winversion: 22631</Data> 
 </EventData>

Fixed Issues

SigmaHQ Rule Creation Conventions

If your PR adds new rules, please consider following and applying these conventions

nasbench · 2024-07-31T08:20:48Z

Winscp can be used as a portable exe so the rule uncommon location, can't be a detection but at best threat hunting
Same goes with the command open rule. You can't say any command open is a "medium" event

…ion_win_winscp_portable_execution.yml

…are report new: FTP Connection Open Attempt Via Winscp CLI new: Winscp Execution From Non Standard Folder --------- Co-authored-by: nasbench <nasbench@users.noreply.github.com> Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>

github-actions Bot added Rules Windows Pull request add/update windows related rules labels Jul 30, 2024

nasbench added the Work In Progress Some changes are needed label Jul 31, 2024

nasbench self-assigned this Jul 31, 2024

nasbench self-requested a review July 31, 2024 08:20

nasbench marked this pull request as draft July 31, 2024 08:21

nasbench marked this pull request as ready for review August 1, 2024 21:33

swachchhanda000 approved these changes Sep 4, 2025

View reviewed changes

nasbench approved these changes Oct 12, 2025

View reviewed changes

nasbench added Ready to Merge and removed Work In Progress Some changes are needed labels Oct 12, 2025

nasbench added this to the Sigma-October-Release milestone Oct 12, 2025

frack113 and others added 6 commits October 14, 2025 11:59

$@frack113$

Winscp rule from Akira Ransomware report

3f4f34b

$@frack113$

Move to threat_hunting

39c2e15

$@frack113$

Fix yaml error

a2442a2

$@frack113$

Fix V2 specification error

afc2e73

Update and rename proc_creation_win_winscp_portable.yml to proc_creat…

f590662

…ion_win_winscp_portable_execution.yml

Create proc_creation_win_winscp_command_open_ftp.yml

47bb10d

swachchhanda000 force-pushed the akira-ransomware branch from 5e4c918 to 47bb10d Compare October 14, 2025 06:14

swachchhanda000 force-pushed the master branch from a6254cb to b9a91bb Compare October 16, 2025 05:16

frack113 and others added 2 commits October 16, 2025 19:02

$@frack113$

Merge branch 'master' into akira-ransomware

82a78f7

Merge branch 'master' into akira-ransomware

2a0c4e5

swachchhanda000 merged commit 296754c into SigmaHQ:master Oct 20, 2025
13 checks passed

$@frack113$

frack113 deleted the akira-ransomware branch October 20, 2025 17:02

Navigation Menu

Uh oh!

Uh oh!

Winscp rule from Akira Ransomware report - #4939

Winscp rule from Akira Ransomware report#4939
swachchhanda000 merged 8 commits into
SigmaHQ:masterfrom
frack113:akira-ransomware

$@frack113$ frack113 commented Jul 30, 2024 •

edited by nasbench

Loading

Uh oh!

nasbench commented Jul 31, 2024

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

frack113 commented Jul 30, 2024 • edited by nasbench Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of the Pull Request

Changelog

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

Uh oh!

nasbench commented Jul 31, 2024

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

$@frack113$ frack113 commented Jul 30, 2024 •

edited by nasbench

Loading