Threat video1:00
Beast Ransomware Shadow Copy Deletion: Detection & IOCs
Beast stops 52 processes and 73 services before deleting shadow copies. 9 detection rules, 27 IOCs and a free Splunk SPL rule.
Read the full threat intel for Beast Ransomware Shadow Copy Deletion: Detection & IOCs →
Chapters
- 0:00The hookBeast ransomware deletes shadow copies.
- 0:04The storyBeast's developer rebranded as GodDamn.
- 0:10Attack pathIt reportedly stops backup services.
- 0:24AttributionAttributed to Hyadina.
- 0:28Indicators of compromise20 indicators to hunt: 3 IPs, 1 domain and 1 URL, and more.
- 0:35MITRE ATT&CK techniques24 ATT&CK techniques, from initial access to impact.
- 0:39Remediation5 steps now: Alert on WMI Win32_ShadowCopy DeleteInstance, vssadmin/wmic shadow deletion and mass.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Beast ransomware deletes shadow copies.
0:05Beast's developer rebranded as GodDamn.
0:08Symantec links them to Hyadina.
0:11It reportedly stops backup services.
0:13Then it deletes shadow copies.
0:15It discovers SMB hosts, then encrypts files.
0:19A Tor leak site adds double extortion.
0:24Attributed to Hyadina. Confidence: medium.
0:2920 indicators to hunt: 3 IPs, 1 domain and 1 URL, and more.
0:3524 ATT&CK techniques, from initial access to impact.
0:405 steps now: Alert on WMI Win32_ShadowCopy DeleteInstance, vssadmin/wmic shadow deletion and mass.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.