Windows: Access to .bluesky Files and Shares Used in BlueSky Ransomware Artifacts

title: "Windows: Access to .bluesky Files and Shares Used in BlueSky Ransomware Artifacts"
id: d13d05d5-5220-4c96-a1e1-3412ace7f015
status: test
description: This rule flags Windows Security events indicating access to file objects or network shares whose names and contents match patterns associated with BlueSky ransomware artifacts (such as objects ending in .bluesky and containing the text "DECRYPT FILES BLUESKY"). Attackers may use such naming to mark encrypted content or associated operational files, making it a useful signal for identifying active or prior encryption attempts. It relies on Windows file access telemetry (Event IDs 4656 and 4663) and share access telemetry (Event ID 5145) with object name/target name matching.
references:
  - https://unit42.paloaltonetworks.com/bluesky-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/BlueSky-Ransomware/win_security_malware_bluesky_ransomware_files_indicators.yml
author: j4son, Huntrule Team
date: 2023-05-23
tags:
  - attack.impact
  - attack.t1486
  - detection.emerging-threats
logsource:
  product: windows
  service: security
detection:
  selection_access_eid:
    EventID:
      - 4663
      - 4656
  selection_access_data:
    - ObjectName|endswith: .bluesky
    - ObjectName|contains: DECRYPT FILES BLUESKY
  selection_share_eid:
    EventID: 5145
  selection_share_data:
    - RelativeTargetName|endswith: .bluesky
    - RelativeTargetName|contains: DECRYPT FILES BLUESKY
  condition: all of selection_access_* or all of selection_share_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: eee8311f-a752-44f0-bf2f-6b007db16300
    type: derived