GodDamn Ransomware — PoisonX BYOVD Hunt & Hardening Pack

Looks for: the GodDamn locker by filename, by published SHA-256, or run from a profile Music/Downloads folder. Accomplishes: the highest-fidelity impact signal. FP: low — the name/hash are unique to this campaign.

// HUNT: GodDamn encryptor execution (T1486)
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 w/ CommandLine + hashes
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^encrypter-windows-gui-x86\.exe$/i
   or SHA256HashData=/^e097f3b445b63b07afacde8d6a67f0be654dd51e228a3610fb0710a1f7e29a69$/i
   or ImageFileName=/\\Users\\[^\\]+\\(Music|Downloads)\\encrypter-windows-gui-x86\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, SHA256HashData, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: the PoisonX driver written to disk by name/hash, or a kernel-mode service being created that points at g11.sys. Accomplishes: catches the EDR-kill step before/while it fires — the single most important detection. FP: low — a driver named g11.sys installed as a kernel service is not a normal endpoint event.

// HUNT: GodDamn PoisonX signed-driver BYOVD (T1068 / T1562.001)
// CONF: high  FP: low  COST: low | REQUIRES: PeFileWritten + ProcessRollup2
#event_simpleName=/PeFileWritten|ProcessRollup2|SyntheticProcessRollup2/
| (TargetFileName=/\\g11\.sys$/i
   or SHA256HashData=/^2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d$/i
   or CommandLine=/sc(\.exe)?\s+create.{0,80}g11\.sys|g11\.sys.{0,40}type=\s*kernel|binpath.{0,40}g11\.sys/i)
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, SHA256HashData, FileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: a binary named symantec.exe by the campaign hash or running/written under a user Music folder — legitimate Symantec binaries live under Program Files, never \Music\. Accomplishes: catches the masquerade dropped alongside PoisonX. FP: low.

// HUNT: GodDamn symantec.exe masquerade (T1036.005)
// CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/
| (SHA256HashData=/^b29f91a440527fb621d106a2048f6379fff3263c60aeda9c82ff8c1d5ae880a8$/i
   or ImageFileName=/\\Users\\[^\\]+\\Music\\symantec\.exe$/i
   or TargetFileName=/\\Users\\[^\\]+\\Music\\symantec\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, TargetFileName, SHA256HashData, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: AnyDesk running from a Music folder, being silently installed/service-set, or a non-default AnyDesk_D service. Accomplishes: catches the remote-access + persistence step. FP: medium where AnyDesk is sanctioned — allow-list approved AnyDesk hosts and alert on the Music-path / AnyDesk_D variants.

// HUNT: GodDamn AnyDesk unattended-access abuse (T1219 / T1543.003)
// CONF: medium  FP: medium  COST: low
// TUNING: exclude AIDs where AnyDesk is an approved RMM; Music-path + AnyDesk_D are the high-signal branches
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|CreateService|ModifyServiceBinary|ServiceStarted/
| (ImageFileName=/\\Users\\[^\\]+\\Music\\anydesk\.exe$/i
   or CommandLine=/anydesk.{0,40}(--install|--start-service|--set-password|ad\.security\.interactive_access)/i
   or ServiceName=/^AnyDesk_D$/i
   or ServiceDisplayName=/AnyDesk_D/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, ServiceName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: Mimikatz (mimik.exe / known hash) and the NirSoft credential-recovery tools, or anything staged under \Music\mimik\pass\. Accomplishes: catches the credential-access stage. FP: medium — some NirSoft tools are used by admins/IR; the \mimik\pass\ path and the Mimikatz hash are the high-confidence branches.

// HUNT: GodDamn Mimikatz + NirSoft credential sweep (T1003 / T1555.003 / T1552.001)
// CONF: high  FP: medium  COST: low
// TUNING: allow-list sanctioned IR/admin use of NirSoft; path + Mimikatz hash are decisive
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/
| (SHA256HashData=/^31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc$/i
   or FileName=/^(mimik|mimikatz|WebBrowserPassView|ChromePass|PasswordFox|MessengerPass|VNCPassView|MailPassView|SniffPass|OperaPassView|CredentialsFileView|WirelessKeyView|netpass|PstPassword|netscan)(\.exe)?$/i
   or ImageFileName=/\\Music\\mimik\\pass\\/i
   or TargetFileName=/\\Music\\mimik\\pass\\/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: PsExec by the campaign hash, by service binary name (psexesvc), or a remote-target command line spawning cmd/powershell under SYSTEM. Accomplishes: catches the lateral-movement stage. FP: medium — PsExec is a legitimate admin tool; allow-list sanctioned admin hosts/AIDs.

// HUNT: GodDamn PsExec lateral movement (T1570 / T1021.002)
// CONF: medium  FP: medium  COST: low
// TUNING: exclude sanctioned admin/jump hosts and IT deployment AIDs
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (SHA256HashData=/^141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944$/i
   or FileName=/^psexe(c|svc)(\.exe)?$/i
   or CommandLine=/psexec.{0,60}(-accepteula|-s\b|-d\b).{0,60}(cmd|powershell)/i)
| groupBy([aid, ComputerName, UserName], function=[count(), collect([FileName, CommandLine], limit=15)])
| sort(_count, order=desc)

Looks for: files written/renamed with the .God8Damn extension, grouped by host to surface the encryption burst. Accomplishes: confirms impact. FP: none expected for the extension; COST is medium because file events are high-volume — scope the window. Note the operator sometimes uses the victim org name as the extension, so pair with Q1.

// HUNT: GodDamn encrypted-file writes (T1486)
// CONF: high  FP: low  COST: medium | scope to a tight window for large estates
#event_simpleName=/PeFileWritten|RansomFileAccessInfo/
| TargetFileName=/\.God8Damn$/i
| groupBy([aid, ComputerName], function=[count(as=encrypted_files), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])
| sort(encrypted_files, order=desc)

Looks for: outbound connections to the four AnyDesk relay IPs Symantec observed. Accomplishes: network-side pivot to correlate with host artifacts. FP: high — these overlap legitimate AnyDesk relay infrastructure, so this is not a standalone alert. Only escalate a host that also fired Q2/Q3/Q4.

// HUNT: GodDamn AnyDesk relay egress — PIVOT ONLY (T1219)
// CONF: medium  FP: high  COST: low | relay IPs overlap benign AnyDesk
// TUNING: pivot only — never alert standalone; escalate only hosts also matching Q2/Q3/Q4
#event_simpleName=/NetworkConnectIP4/
| RemoteAddressIP4=/^(15\.235\.230\.188|185\.229\.191\.39|141\.95\.145\.210|162\.19\.171\.150)$/
| groupBy([aid, ComputerName, RemoteAddressIP4], function=[count(), max(@timestamp, as=last_seen)])
| sort(_count, order=desc)