Threat video1:00
LockBit 4.0 Green Encryptor RE: Analysis & Hunting
LockBit 4.0 Green reuses Conti-derived code, patches ETW and exits on Russian keyboard layouts: 9 detection rules, 19 IOCs and a free Splunk SPL rule.
Read the full threat intel for LockBit 4.0 Green Encryptor RE: Analysis & Hunting →
Chapters
- 0:00The hookLockBit 4.0 encryptor reverse engineered.
- 0:04The storyFebruary 4.0 released.
- 0:10Attack pathCustom hashing masks API calls.
- 0:23AttributionAttributed to LockBit.
- 0:28Indicators of compromise14 indicators to hunt: 7 domains, 2 SHA-256 hashes and 1 MD5 hash, and more.
- 0:38MITRE ATT&CK techniques15 ATT&CK techniques, from initial access to impact.
- 0:42Remediation5 steps now: Hunt for Restore-My-Files.txt ransom notes and the FBIsosite footer marker.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00LockBit 4.0 encryptor reverse engineered.
0:05February 4.0 released.
0:07It hides Windows logs.
0:11Custom hashing masks API calls.
0:13Telemetry patched to silence.
0:15Shadow copies deleted.
0:17Event logs cleared.
0:19Files encrypted, ransom note dropped.
0:24Attributed to LockBit. Confidence: medium.
0:2814 indicators to hunt: 7 domains, 2 SHA-256 hashes and 1 MD5 hash, and more.
0:3815 ATT&CK techniques, from initial access to impact.
0:435 steps now: Hunt for Restore-My-Files.txt ransom notes and the FBIsosite footer marker.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.