Technical Tip: How to use FortiAnalyzer to detect activities related to REvil Ransomware targeting Kaseya VSA vulnerability

[keithli_FTNT]

Description
This article describes how to use a custom Event Handler and Report in FortiAnalyzer to detect REvil Ransomware that targets Kaseya VSA vulnerability.

For more information on the threat, see the FortiGuard Lab Threat Signal Report:

Global ransomware and supply-chain attack on Kaseya VSA affecting multiple organizations

What is included in Fortinet_SOC-REvil-Detection-v3.zip?

1) REvil Ransomware Detection-v3.json

This event handler helps identify exploit attempts detected by FortiGate's and FortiClient's AV signatures. Logs triggering the event handler are generated from FortiGate and FortiClient. Therefore, their corresponding AV signature should be kept up to date to prevent and log the exploits.

2) REvil_ransomware_detection_report-v3.dat

A report to summarize findings on exploit attempts using REvil ransomware, as detected by the AV Engine on FortiGate and FortiClient devices.

See the Solution section for instruction on how to load the event handler into a FortiAnalyzer unit.

Scope
The custom Event Handler and Report provided can be used in FortiAnalyzer 6.4+.
Solution

All screen shots provided below for illustration purposes are taken from FortiAnalyzer 6.4.4.

1) Download the Fortinet_SOC-REvil-Detection-v3.zip file (contains 2 files)

2) Unzip Fortinet_SOC-REvil-Detection-v3.zip

3) Use REvil Ransomware Detection-v3.json to import into Event Handlers

    a. Choose an ADOM (if ADOMs are enabled)

    b. Choose the FortiSOC module

    c. Select Event Handler List

    d. Select the Import option under "More"

    e. Select REvil Ransomware Detection-v3.json

Result: REvil Ransomware Detection-v3.json is enabled and will be triggered if the appropriate logs are received after after the event handler was imported

4) Use REvil_ransomware_detection_report-v3.dat to import into Reports

    a. Choose a Fabric ADOM (if ADOMs are enabled)

    b. Choose the Report module

    c. Select the Import option under "More"

    d. Select REvil_ransomware_detection_report-v3.dat

Result: 'REvil_ransomware_detection_report-v3.dat' can be run anytime as determined by an admin user.