Modifying the registry to add a ransom message notification

Hunt Hypothesis

Adversaries are likely leaving ransomware notification messages in the registry to communicate demands, a common tactic to

KQL Query

DeviceProcessEvents 
| where InitiatingProcessCommandLine has_all('"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f', 'RecoveryKeyMessage', 'Your drives are Encrypted!', '@') 

Analytic Rule Definition

id: acd4112f-5271-4680-ab2a-f07952d71888
name: Modifying the registry to add a ransom message notification
description: |
  Identify registry modifications that is indicative of a ransom note tied to DEV-0270.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Impact
query: |   
  DeviceProcessEvents 
  | where InitiatingProcessCommandLine has_all('"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f', 'RecoveryKeyMessage', 'Your drives are Encrypted!', '@') 

Required Data Sources

False Positive Guidance

• **Scenario: System Cleanup

MITRE ATT&CK Context

• Tactic: Impact

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Ransomware/DEV-0270/Modifying the registry to add a ransom message notification.yaml)