Sunturai
Back to results
MediumSplunk security contentRico Valdez +1

Samsam Test File Write

The following analytic detects the creation of a file named "test.txt" within the Windows system directory, indicative of Samsam ransomware propagation. It leverages file-system activity data from the Endpoint data…

Description

The following analytic detects the creation of a file named "test.txt" within the Windows system directory, indicative of Samsam ransomware propagation. It leverages file-system activity data from the Endpoint data model, specifically monitoring file paths within the Windows System32 directory. This activity is significant as it aligns with known Samsam ransomware behavior, which uses such files for propagation and execution. If confirmed malicious, this could lead to ransomware deployment, resulting in data encryption, system disruption, and potential data loss. Immediate investigation and remediation are crucial to prevent further damage.

Detection logic

Detection requirements

Platform
ESXiIaaSLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_eventid_11

Known benign triggers

  • No false positives have been identified.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice