<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-ransomware-affiliate-tools
description: >-
  Detect tools commonly used by ransomware affiliates during intrusions
  including Cobalt Strike, Brute Ratel, Sliver, SystemBC, Mimikatz,
  Advanced IP Scanner, Rclone, and custom loaders. Provides YARA rules,
  behavioral signatures, network indicators, and process-level detection
  for the affiliate toolkit ecosystem.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - affiliate-tools
  - cobalt-strike
  - brute-ratel
  - sliver
  - mimikatz
  - systembc
  - rclone
  - detection-engineering
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Detecting Ransomware Affiliate Tools

## Overview

Ransomware affiliates rely on a well-known toolkit ecosystem. While
payloads change, the tools used for C2, credential theft, lateral
movement, and exfiltration are remarkably consistent. Detecting these
tools provides reliable early warning regardless of which ransomware
family is ultimately deployed.

Top affiliate tools: Cobalt Strike (60%+ of incidents), Mimikatz,
Advanced IP Scanner, Rclone, AnyDesk, SystemBC, and Brute Ratel.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| YARA | Binary pattern matching | `pip install yara-python` |
| Sysmon | Process telemetry | `sysmon64 -i config.xml` |
| Sigma CLI | Rule conversion | `pip install sigma-cli` |
| Zeek | Network detection | `apt install zeek` |
| Suricata | Network IDS | `apt install suricata` |

## Key Concepts

### Affiliate Tool Matrix

| Tool | Stage | MITRE ID | Detection Priority |
|------|-------|----------|-------------------|
| Cobalt Strike | C2 | T1071.001 | Critical |
| Brute Ratel | C2 | T1071.001 | Critical |
| Sliver | C2 | T1071.001 | High |
| Mimikatz | Credential Theft | T1003.001 | Critical |
| SystemBC | Proxy/Tunnel | T1090 | High |
| Advanced IP Scanner | Recon | T1046 | High |
| Rclone | Exfiltration | T1567.002 | Critical |
| AnyDesk/ScreenConnect | Remote Access | T1219 | High |
| PsExec | Lateral Movement | T1021.002 | High |
| Rubeus | Kerberoast | T1558.003 | Critical |

### Detection Layer Coverage

```
Layer 1: Network — C2 beacon patterns, JA3/JA3S, DNS anomalies
Layer 2: Endpoint — Process creation, named pipes, loaded DLLs
Layer 3: Memory — In-memory tool signatures, reflective loading
Layer 4: Behavioral — Command sequences, timing patterns
```

## Workflow

### Step 1 — Sigma Rules for Affiliate Tool Detection

```yaml
title: Cobalt Strike Default Named Pipe Detection
id: a3e9f4b2-1c8d-4e7a-b5f6-2d9c8e3a7b1f
status: stable
description: Detects Cobalt Strike default named pipes for C2
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|startswith:
      - '\\MSSE-'
      - '\\postex_'
      - '\\postex_ssh_'
      - '\\status_'
  condition: selection
falsepositives:
  - Custom applications with similar pipe names (verify binary)
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
```

```yaml
title: Rclone Exfiltration Tool Execution
id: c8d4f2a1-7b3e-4c9d-a5f8-1e6b3d9c2a7f
status: stable
description: Detects rclone execution commonly used for data exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: '\\rclone.exe'
  selection_args:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--transfers'
      - 'mega:'
      - 'ftp:'
      - 's3:'
  condition: selection_name and selection_args
falsepositives:
  - Authorized IT backup operations using rclone (whitelist by user/path)
level: critical
tags:
  - attack.exfiltration
  - attack.t1567.002
```

### Step 2 — Network-Level Detection

```bash
# Detect Cobalt Strike JA3 fingerprints
# Common CS JA3: 72a589da586844d7f0818ce684948eea
grep "72a589da586844d7f0818ce684948eea" /var/log/zeek/ssl.log 2>/dev/null

# Detect AnyDesk/ScreenConnect connections
grep -iE "anydesk\.com|screenconnect\.com|connectwise" /var/log/zeek/dns.log 2>/dev/null

# Detect SystemBC SOCKS proxy traffic patterns
grep -E "port=(4001|4444|4445)" /var/log/suricata/eve.json 2>/dev/null | head -20

# Monitor for DNS beaconing patterns (regular interval queries)
cat /var/log/zeek/dns.log | zeek-cut query | sort | uniq -c | sort -rn | \
  awk '$1 > 100 {print $0}' | head -20
```

### Step 3 — Process-Level Detection

```bash
# Detect common affiliate tools by process name
ps aux 2>/dev/null | grep -iE \
  "mimikatz|rubeus|adfind|sharphound|advanced.ip|anydesk|screenconnect|rclone|psexec" | \
  grep -v grep

# Detect suspicious PowerShell (common affiliate entry)
ps aux 2>/dev/null | grep -iE "powershell.*-enc\|powershell.*-nop\|powershell.*downloadstring" | \
  grep -v grep

# Check for Cobalt Strike beacon artifacts
find /tmp /var/tmp /dev/shm -name "*.bin" -o -name "beacon*" -o -name "*.ps1" 2>/dev/null
```

### Step 4 — YARA Rules for Memory Scanning

```bash
# Scan running processes for Cobalt Strike beacon in memory
yara -p 4 cobalt_strike_beacon.yar /proc/*/maps 2>/dev/null

# Scan temp directories for known tool artifacts
yara -r affiliate_tools.yar /tmp /var/tmp /dev/shm 2>/dev/null
```

## Verification

- [ ] Sigma rules deployed for all tools in affiliate matrix
- [ ] Network detection covers JA3 fingerprints for known C2 frameworks
- [ ] Named pipe monitoring active for Cobalt Strike/Sliver defaults
- [ ] Process creation logging captures all affiliate tool executions
- [ ] YARA rules updated quarterly from latest samples
- [ ] Alert response playbook documented per tool category

## References

- MITRE ATT&CK S0154: Cobalt Strike
- MITRE ATT&CK S1063: Brute Ratel C4
- DFIR Report: Affiliate Tooling Analysis
- Recorded Future: Ransomware Affiliate Ecosystem
- SentinelOne: Cobalt Strike Detection Guide
