Storm-0501 Ransomware Analytic Story

[MHaggis]

Storm-0501 Ransomware Analytic Story

Summary

Adds a new analytic story for Storm-0501, a financially motivated RaaS affiliate known for hybrid cloud ransomware attacks targeting government, healthcare, and critical infrastructure sectors.

New Analytic Story

• stories/storm_0501_ransomware.yml

Tagged Detections (14)

Detection	Category
Detect RClone Command-Line Usage	Exfiltration
Common Ransomware Notes	Impact
WBAdmin Delete System Backups	Impact
Suspicious wevtutil Usage	Defense Evasion
Disable Windows Behavior Monitoring	Defense Evasion
Windows Suspicious C2 Named Pipe	Command & Control
Impacket Lateral Movement Commandline Parameters	Lateral Movement
Impacket Lateral Movement WMIExec Commandline Parameters	Lateral Movement
Detect PsExec With accepteula Flag	Lateral Movement
Detect Remote Access Software Usage Process	Command & Control
SecretDumps Offline NTDS Dumping Tool	Credential Access
NLTest Domain Trust Discovery	Discovery
Azure AD New Federated Domain Added	Persistence
Azure AD Privileged Role Assigned	Privilege Escalation

References

• Microsoft: Storm-0501 Ransomware attacks expanding to hybrid cloud environments

[patel-bhavin]

Mostly tagging exsiting detections. LGTM!