CB Response: Watchlist for GrandCrab Ransomware causing errors

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Watchlist query to identify GandCrab Ransomware fails to load

Environment

• CB Response Server: All Versions

Cause

Results based on query of the Watchlist has overwhelmed the Console/Server.

Resolution

TauTin has identified queries to assist with the campaign: 

Word Dropper	parent_name:winword.exe AND process_name:powershell.exe AND netconn_count:[1 TO *]
PowerShell Second Stage	(domain:pastebin.com) and process_name:powershell.exe
PowerShell Second Stage	process_name:powershell.exe AND filemod:ProgramData\*.exe
PowerShell Downgrade	modload:windows\assembly\nativeimages_v*_32\*\*\system.management.automation.ni.dll and parent_name:powershell.exe AND netconn_count:[1 TO *] -cmdline:windows\\ccmcache*
PowerShell Downgrade	modload:windows\assembly\nativeimages_v*_32\*\*\system.management.automation.ni.dll and parent_name:powershell.exe  AND childproc_name:csc.exe and -cmdline:windows\\ccmcache*