Healthcare organizations face increasing challenges in protecting sensitive data and ensuring operational continuity against sophisticated cyber threats. In this case study, the security team of one of the top three healthcare providers in the US shares how they use VMRay’s advanced detection and analysis technologies to strengthen their defenses.
Highlighting real-world threat-hunting use cases, the document showcases how integrating VMRay into an automated security workflow improves detection accuracy, accelerates response efforts, and delivers actionable insights to outpace emerging threats.
This document outlines a series of Threat Hunting use cases focused on detecting and mitigating potential threats related to the execution or download of suspicious files within the environment. Specifically, we explore the integration of VMRay, a malware sandboxing solution, into an automated security workflow to enhance detection and response capabilities.
In this document, we will provide an in-depth overview of one such use case, in which files are executed or downloaded to specific locations—most notably the public user profile, a common target for adversaries staging malware. Suspicious files of various types, including scripts, executables, links, and archives (e.g., ZIP files), are detected through SIEM rules that monitor for file creation activity in these critical locations. Once an alert is triggered, our Security Orchestration, Automation, and Response (SOAR) platform automatically retrieves the suspect file from the endpoint and submits it to VMRay for analysis.
We also highlight real-world examples of such attacks, such as the well-known Ascension Health Care incident, where malicious activity was linked to files staged in the public user folder. While Endpoint Detection and Response (EDR) tools may cover similar behavior, they are not always foolproof. By automatically submitting suspect files to VMRay for deep analysis, we add a crucial layer of defense-in-depth.
The output from VMRay’ s analysis is used to drive programmatic decisions for further response actions, helping to prevent alert fatigue and streamline decision-making. Each file submission is tagged with a SOAR Case ID, enabling seamless cross-referencing and improved tracking of potential threats.
Additionally, we recommend periodic reviews of the VMRay dashboard, as analyzing suspicious file submissions can offer valuable insights into Potentially Unwanted Program (PUP) activity and other hidden threats within the environment.
This SIEM rule is designed to detect potentially suspicious files being created within the public user folder, a location commonly targeted by attackers for staging malicious files.
The rule is configured to monitor specific file types often associated with malicious activity, such as executable files, scripts, and other potentially dangerous file formats. When a file matching the criteria is created, the SIEM generates an individual alert for each file event, enabling a targeted response.
The rule specifically targets files created under the public user profile, focusing on specific file types typically used in malicious payloads or exploits. The rule performs a matching check for files created with these extensions (e.g., .exe, .zip, .bat, .vbs, .js, .url, etc.). It checks whether the file was created with system-level integrity (which is often a sign of privileged or malicious activity) and whether the User field in the event contains the term “Public”, indicating the file was placed in the public folder.
The rule is built using Sigma, an open standard for writing detection rules that are portable across different SIEM platforms. This specific rule detects file creation events and filters for file types that are often associated with malware or malicious scripts.
yaml
Copy code
title: Threat Hunt Suspicious Files Public Users Folder
status: Production
description: Detections of Files being Created in Public User Folder
references:
– See Reference List Below
author: (Redacted)
date: (Redacted)
modified: (Redacted)
logsource:
category: File Creation
product: EDR Solution
detection:
selection:
IntegrityLevel: System
User|contains:
– ‘Public’
selection_special:
– Image|endswith:
‘\.ico’
– ‘\.zip’
– ‘\.wav’
– ‘\.dat’
– ‘\.vbs’
– ‘\.js’
– ‘\.jse’
– ‘\.bat’
– ‘\.url’
– ‘\.cmd’
– ‘\.hta’
– ‘\.ps1’
– ‘\.com’
– ‘\.dll’
– ‘\.exe’
– ‘\.conf’
– ‘\.mui’
condition: all of selection*
falsepositives:
– Administrative activity
– Scripts and administrative tools used in the monitored environment
– Monitoring activity
level: low
The rule specifically looks for file extensions that are commonly associated with malicious files, including but not limited to:
The rule includes considerations for administrative or legitimate tool usage that may generate similar file creation activity. This includes scripts and tools typically used in the environment for legitimate purposes, which could result in false positives. As such, the rule has been configured to flag these activities as low severity.
The primary goal of this SIEM rule is to detect malicious file creation in locations commonly abused by attackers, like the public folder. Once an alert is triggered by the detection of a suspicious file type in the folder, the alert is forwarded to the SOAR platform for automated processing. The file is then downloaded and submitted to VMRay for further sandbox analysis, providing enhanced threat detection and mitigating risks of malware infection.
By monitoring these types of file creation events, security teams can quickly identify and respond to potential threats, reducing the time to detect and mitigate adversary activity.
“The primary goal of this SIEM rule is to detect malicious file creation in locations commonly abused by attackers, like the public folder.”
Once a suspicious file is detected by the SIEM rule and the alert is generated, the corresponding VMRay Playbook is automatically triggered within the SOAR platform. This playbook is designed to facilitate the automated investigation and response process, involving multiple decision points, error handling, and possible actions based on the results at each stage.
The playbook ensures that suspicious files are analyzed promptly, with the results guiding subsequent actions. Below is a high-level flow of the playbook in pseudocode, outlining the key steps and potential actions that can be taken.
To maintain traceability, each file submission is tagged with the SOAR Case ID. This allows security teams to easily reference and track the file across different stages of investigation, whether in the VMRay dashboard or in email alerts.
This ensures that all actions related to a particular file are linked back to the originating alert and associated investigation case.
The following references provide additional context and insights into the behavior and techniques associated with the exploitation of public folders and other similar attack vectors. These resources include reports from various threat intelligence organizations, government agencies, and security researchers. They are particularly valuable for understanding how attackers use public folders and other locations for malware staging, file execution, and data exfiltration.
The following use cases serve as examples of the types of suspicious file activities that can be monitored and automated within your environment. These are not an exhaustive list, but they represent a variety of common tactics used by attackers to execute or distribute malicious files. Each of these use cases is designed to detect specific behaviors related to file execution or unusual file activity that may indicate a security threat.
These example use cases reflect common attack vectors that are critical to monitor for in modern environments. By automating the detection, submission, and analysis of suspicious file behaviors, organizations can proactively identify threats and mitigate potential damage.
While these examples are not all-inclusive, they represent key tactics and techniques commonly used by adversaries to execute or deliver malicious payloads.
“The automated integration with tools like VMRay and the SOAR platform allows for fast and efficient triage, investigation, and response to these threats, ensuring that suspicious file activity is promptly handled and mitigated before it can cause harm.
Check our latest insights on malware, phishing, sandboxing, AI in cybersecurity, and much more.
Browse the courses about alert handling, deep threat analysis and response, threat intelligence generation and more.
See real-world examples of VMRay’s best-in-class malware analysis and detection platform.
join VMRay for two powerhouse webinars designed to sharpen your threat detection and response capabilities — featuring a special joint session with Red Canary:
Live session's over. Watch the on-demand video to learn how VMRay and Red Canary combine forces to deliver faster, smarter threat detection!
Learn how to cut phishing triage time with automated detonation and deep analysis — quickly uncover threats while improving response accuracy!
