Threat video1:00
DarkSide v1.8.6.2 UAC Bypass Teardown: Detection & IOCs
DarkSide v1.8.6.2 deletes shadow copies and kills backup services. First documented in 2021, it has 9 detection rules, 15 IOCs and a free Splunk SPL rule.
Read the full threat intel for DarkSide v1.8.6.2 UAC Bypass Teardown: Detection & IOCs →
Chapters
- 0:00The hookEighteen attack techniques encrypt targets.
- 0:04The storyResearchers analyzed Darkside ransomware.
- 0:10Attack pathIt escalates via UAC bypass, deletes shadows.
- 0:24AttributionAttributed to DarkSide.
- 0:28Indicators of compromise8 indicators to hunt: 3 domains, 1 URL and 1 SHA-256 hash, and more.
- 0:37MITRE ATT&CK techniques18 ATT&CK techniques, from execution to impact.
- 0:41Remediation4 steps now: Block securebestapp20[.]com and temisleyes[.]com at DNS and egress proxies.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Eighteen attack techniques encrypt targets.
0:05Researchers analyzed Darkside ransomware.
0:08Targets high-value organizations.
0:11It escalates via UAC bypass, deletes shadows.
0:14Stops services, kills processes.
0:16Encrypts files: Salsa-20 and RSA.
0:20Drops ransom note, self-deletes.
0:24Attributed to DarkSide. Confidence: low.
0:298 indicators to hunt: 3 domains, 1 URL and 1 SHA-256 hash, and more.
0:3718 ATT&CK techniques, from execution to impact.
0:424 steps now: Block securebestapp20[.]com and temisleyes[.]com at DNS and egress proxies.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.