Skip to content

Instantly share code, notes, and snippets.

@mgreen27

mgreen27/impact.vql

Last active February 16, 2023 05:59
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save mgreen27/7ff1a83b429af7e65ae384ebb43f42c6 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save mgreen27/7ff1a83b429af7e65ae384ebb43f42c6 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. mgreen27 revised this gist Feb 16, 2023. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions impact.vql
    View file
    Original file line number Diff line number Diff line change
    @@ -12,6 +12,7 @@ SELECT
    --max(item=LastRecordChange0x10) as LatestRecordChange,
    count() as Total
    FROM source(artifact="Windows.NTFS.MFT")
    WHERE FileName = 'RANSOMNOTEFILENAME'
    GROUP BY Drive

    /*
    @@ -28,4 +29,5 @@ SELECT
    max(item=LastRecordChange0x10) as LatestRecordChange,
    count() as Total
    FROM source(artifact="Windows.NTFS.MFT")
    WHERE FileName =~ 'RAMSOMEXT$'
    GROUP BY Drive
  2. mgreen27 created this gist Feb 16, 2023.
    31 changes: 31 additions & 0 deletions impact.vql
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,31 @@
    /*
    ### Drive Ransom note stats
    */
    SELECT
    strip(string=split(string=OSPath,sep=':')[0],prefix='''\\.\''') as Drive,
    FileName as RansomeNote,
    --min(item=Created0x10) as EarliestCreation,
    --max(item=Created0x10) as LatestCreation,
    min(item=LastModified0x10) as EarliestModified,
    max(item=LastModified0x10) as LatestModified,
    --min(item=LastRecordChange0x10) as EarliestRecordChange,
    --max(item=LastRecordChange0x10) as LatestRecordChange,
    count() as Total
    FROM source(artifact="Windows.NTFS.MFT")
    GROUP BY Drive

    /*
    ### Drive Ransom file stats
    */
    SELECT
    strip(string=split(string=OSPath,sep=':')[0],prefix='''\\.\''') as Drive,
    split(string=FileName,sep_string='.') [-1] as Extension,
    --min(item=Created0x10) as EarliestCreation,
    --max(item=Created0x10) as LatestCreation,
    min(item=LastModified0x10) as EarliestModified,
    max(item=LastModified0x10) as LatestModified,
    min(item=LastRecordChange0x10) as EarliestRecordChange,
    max(item=LastRecordChange0x10) as LatestRecordChange,
    count() as Total
    FROM source(artifact="Windows.NTFS.MFT")
    GROUP BY Drive