MASIVO: Attacker Behavior Analytics > Suspicious Network Request: BlackSuit IOCs

InsightIDR
1

Are you all getting this notiffications…?
We manage plenty of tenants, and all getting this alerts. I tried to disable them turning them off, but still getting e-mails.

Created a Critical case on the support center, but no response yet.

Thoughts?

4 Likes
2

We’ve gotten a handful of those. None of our other tools are alerting and on one of them the address was reported as “slscr.update.microsoft.com”, which is Windows Update. So it appears to be a false positive, but we’re monitoring.

2 Likes
3

Thank you @lwagner , really appreciate.
No statement yet from Rapid7…

4

Please do update this if you hear something just so we’ve got confirmation. Thanks!

5

Created By : Salesforce System 8/9/2024, 11:12
Hey mmur, How are you? Yes we are seeing this coming in for many customers at the moment as the detection rule was updated with additional IoCs. I would recommend if you see these alerts as benign to implement your own exceptions while our detection rule team looks into the alert. Kind Regards, Lee How am I doing?

6

Interesting, when I looked at the rule it is turned off, but the date modified is still in July…

image

7

Hi there. The rule has been turned off for evaluation. Yesterday IOCs were added from a recent CISA report related to BlackSuit.

8

was this turned off because of these alerts? it says last modified July.

9

I did it myself but still receiving alerts…

10

Interesting because in that case how trustworthy are the datestamps?

11

We haven’t received any since about 30 minutes ago.

12

I’ve been hit with a load of these, IPs track back to MS but they’re all listed in here - #StopRansomware: Blacksuit (Royal) Ransomware | CISA
Glad I found this thread, I nearly puked :smiley:

2 Likes
13

15 for me, thanks for the feedback

14

I’m laughing at your post because it looks like you went through the same process as me -

  • saw they were Microsoft IP’s
  • checked the CISA article
  • noticed the IP’s matched
  • I didn’t nearly puke but did consider going for a strong cup of tea
3 Likes
15

I think in this case, CISA did a pretty poor job at attribution and should of done a lot more work before including all those IOCs in the report.

2 Likes
16

we received 5 notifications which matched this

“destination_address”: “93.184.221.240”,IPHub
“destination_port”: “80”,

this is the IOC entry from CISA: https://www.cisa.gov/sites/default/files/2024-08/aa23-061a-stopransomware-blacksuit-royal-ransomware.pdf

93.184.221[.]240 July 2024 IP associated with reverse lookup of Socss.exe

so can we ignore it?

17

Based on the information gathered both from looking at the domains in the investigations and information from this threat and the CISA page linked in this thread. Combined with the fact that it looks like Rapid7 has turned the detection rule off for our environment. I would say its most likely a false positive caused by attribution error. But keeping an eye out for further information. Or maybe a message from Rapid7 themselves.

2 Likes
18

Have there been any additional updates on this issue over the weekend? We got a lot of these alerts last Friday and put our entire department on high alert.

It seems like it is likely a false positive, but I’d like to see an official statement or something.

19

Hey @cpitcher , no statement at all, at least they replied me last night with the following:

"Hi,

Our SOC Team has notified us that the detection rules have been re-enabled, and the correct rules are now in place.

  • Suspicious Process: BlackSuit Related Binary Executed

  • Suspicious Asset Authentication: Hostname Related to BlackSuit Ransomware

  • Suspicious Web Request: BlackSuit URL Observed

Please let us know if you have any further questions or concerns.

Amr Saleh

Senior Manager, Technical Support

Rapid7"

1 Like
20

Thank you!