{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Settra ransomware poses a severe risk to business continuity through data destruction. Identifying the transition from defensive evasion (BYOVD) to impact (Anti-recovery/Encryption) provides confirmation of an active intrusion." }, "name": "Settra Ransomware Local Impact and Recovery Inhibition", "type": "investigation", "labels": [ "hunt", "attack.t1486", "attack.t1059.001", "attack.t1562.001", "attack.t1070.001", "attack.t1490" ], "series": { "slug": "ready-settra-go-new-settra-ransomware-variant-deploys-meshagent-rmm", "index": 2, "title": "Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM", "total": 2 }, "related": [ { "hunt": "settra-rmm-persistence-meshagent", "reason": "This hunt focuses on the local impact and encryption stage; RMM persistence is a separate precursor stage.", "relation": "out-of-scope-alternative" }, { "hunt": "settra-persistence-meshagent-remote-access", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple detection rule might fire on 'reagentc /disable', but this hunt uses a phased flow to correlate that command with domain-specific binary execution and BYOVD driver drops. This contextual weighting creates a complete attack timeline.", "coverage": [ { "stage": "defense-evasion-byovd", "steps": [ "byovd-driver-search" ], "status": "covered" }, { "stage": "execution-ransomware-launcher", "steps": [ "launcher-execution-search" ], "status": "covered" }, { "stage": "anti-recovery-and-evasion", "steps": [ "anti-recovery-baseline" ], "status": "covered" }, { "stage": "impact-data-encryption", "steps": [ "encryption-artifact-search" ], "status": "covered" }, { "stage": "initial-access-remote-services", "reason": "Belongs to another part of the 'Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM' series.", "status": "out_of_scope" }, { "stage": "persistence-rmm-meshagent", "reason": "Belongs to another part of the 'Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "External Remote Service Compromise", "slug": "initial-access-remote-services", "tactic": "initial-access", "techniques": [ "T1133", "T1021.001" ], "observables": [ "VPN credential compromise", "RDP session usage" ] }, { "name": "Persistence via MeshAgent RMM", "slug": "persistence-rmm-meshagent", "tactic": "persistence", "observables": [ "mvtcs.exe", "MeshAgent RMM installation", "45.13.122.7", "193.5.65.114", "Workstation name WIN-LIVFRVQFMKO" ] }, { "name": "BYOVD Security Tool Disabling", "slug": "defense-evasion-byovd", "tactic": "defense-evasion", "observables": [ "gdrv.sys", "Disable antivirus services" ] }, { "name": "Settra Ransomware Execution", "slug": "execution-ransomware-launcher", "tactic": "execution", "observables": [ "*_win64.exe", "C:\\Perflogs", "\\Documents\\*_win64.exe" ] }, { "name": "Inhibit Recovery and Clear Logs", "slug": "anti-recovery-and-evasion", "tactic": "defense-evasion", "techniques": [ "T1059.001" ], "observables": [ "reagentc /disable", "ipconfig /flushdns", "diskpart.exe execution with recovery partition script", "cipher /w:", "wevtutil log clearing (Application, Security, System, Setup, ForwardedEvents)", "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational", "Microsoft-Windows-TerminalServices-RDPClient/Operational", "Microsoft-Windows-Sysmon/Operational", "Microsoft-Windows-PowerShell/Operational", "Microsoft-Windows-WinRM/Operational", "Microsoft-Windows-TaskScheduler/Operational", "Microsoft-Windows-Windows-Defender/Operational" ] }, { "name": "Data Encrypted for Impact", "slug": "impact-data-encryption", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ ".locked extension", ".locked_wip extension", "RESTORE_FILES.txt" ] } ], "summary": "Settra ransomware incidents involve initial persistence via MeshAgent RMM and the use of BYOVD (gdrv.sys) to disable security tools before executing a ransomware binary named after the victim domain. The threat actor employs extensive anti-recovery measures including clearing multiple event logs, disabling the Windows Recovery Environment, and overwriting free disk space using native Windows utilities." }, "severity": "critical", "rationale": "Focus on Windows endpoints, specifically servers and admin workstations. Widen the scope if MeshAgent RMM activity has been observed.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is executing Settra ransomware, using a domain-specific launcher and a BYOVD driver to disable defenses before inhibiting recovery and encrypting files.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping-input", "kind": "manual", "observed": "2026-09-17" }, "type": "list[host]", "default": [], "description": "Specific hostnames to focus on; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "hunt-standard-lookback", "kind": "manual", "observed": "2026-09-17" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/new-settra-ransomware-variant", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/new-settra-ransomware-variant", "name": "Huntress \u2014 Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM" } ], "blind_spots": [ { "id": "misspelled-log-evasion", "risk": "Visibility into local defense actions will be lost if the typo is fixed in future versions.", "stage": "anti-recovery-and-evasion", "question": "Which security events were recorded because the attacker misspelled the log path?", "requires": "Microsoft-Windows-Defender/Operational log configuration" }, { "id": "diskpart-script-visibility", "risk": "While the execution of diskpart is visible, the specific actions cannot be confirmed without the script content.", "stage": "anti-recovery-and-evasion", "question": "What instructions were contained in the diskpart script?", "requires": "hb_script_activity text capture for diskpart" }, { "id": "endpoint-telemetry-gap", "risk": "If the agent is killed before it can report the early-stage signals, the hunt will fail to see the compromise.", "question": "Are there hosts where Settra is active but the agent is not reporting?", "requires": "Consistent EDR agent coverage across all Windows hosts" } ] }, "name": "Settra Ransomware Local Impact and Recovery Inhibition", "description": "This hunt follows the Settra ransomware attack chain on the endpoint, focusing on the transition from defense evasion to data destruction. It first identifies early indicators such as the drop of a vulnerable gdrv.sys driver and the execution of a domain-named launcher. The hunt then phases into a follow-on stage that correlates these leads with anti-recovery behaviors\u2014disabling Windows Recovery, wiping free space, and clearing event logs\u2014and the presence of encrypted file artifacts. This phased approach distinguishes malicious ransomware activity from legitimate administrative maintenance." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "ready-settra-go-new-settra-ransomware-variant-deploys-meshagent-rmm", "index": 2, "title": "Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM", "total": 2 }, "coverage": [ { "stage": "defense-evasion-byovd", "steps": [ "byovd-driver-search" ], "status": "covered" }, { "stage": "execution-ransomware-launcher", "steps": [ "launcher-execution-search" ], "status": "covered" }, { "stage": "anti-recovery-and-evasion", "steps": [ "anti-recovery-baseline" ], "status": "covered" }, { "stage": "impact-data-encryption", "steps": [ "encryption-artifact-search" ], "status": "covered" }, { "stage": "initial-access-remote-services", "reason": "Belongs to another part of the 'Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM' series.", "status": "out_of_scope" }, { "stage": "persistence-rmm-meshagent", "reason": "Belongs to another part of the 'Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM' series.", "status": "out_of_scope" } ], "rationale": "An adversary is executing Settra ransomware, using a domain-specific launcher and a BYOVD driver to disable defenses before inhibiting recovery and encrypting files.", "blind_spots": [ { "id": "misspelled-log-evasion", "risk": "Visibility into local defense actions will be lost if the typo is fixed in future versions.", "stage": "anti-recovery-and-evasion", "question": "Which security events were recorded because the attacker misspelled the log path?", "requires": "Microsoft-Windows-Defender/Operational log configuration" }, { "id": "diskpart-script-visibility", "risk": "While the execution of diskpart is visible, the specific actions cannot be confirmed without the script content.", "stage": "anti-recovery-and-evasion", "question": "What instructions were contained in the diskpart script?", "requires": "hb_script_activity text capture for diskpart" }, { "id": "endpoint-telemetry-gap", "risk": "If the agent is killed before it can report the early-stage signals, the hunt will fail to see the compromise.", "question": "Are there hosts where Settra is active but the agent is not reporting?", "requires": "Consistent EDR agent coverage across all Windows hosts" } ], "scoping_notes": "Focus on Windows endpoints, specifically servers and admin workstations. Widen the scope if MeshAgent RMM activity has been observed.", "beyond_detection": "A simple detection rule might fire on 'reagentc /disable', but this hunt uses a phased flow to correlate that command with domain-specific binary execution and BYOVD driver drops. This contextual weighting creates a complete attack timeline." } }, { "id": "windows-host-inventory", "type": "query", "label": "Identify Windows host estate", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT hostname AS device_hostname, os_version, last_seen FROM hb_devices WHERE LOWER(platform) = 'windows' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_devices", "description": "Scope the hunt to Windows endpoints where the Settra ransomware variant is known to operate.", "expected_signal": "A list of active Windows hosts. Silence proves no Windows hosts have reported inventory within the lookback window." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify Windows host estate", "reads": [ "hostname", "platform", "time", "os_version", "last_seen" ], "source": "hb_devices", "target": "endpoint", "content": "SELECT DISTINCT hostname AS device_hostname, os_version, last_seen FROM hb_devices WHERE LOWER(platform) = 'windows' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of active Windows hosts. Silence proves no Windows hosts have reported inventory within the lookback window.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "byovd-driver-search", "type": "query", "label": "BYOVD driver drop", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(file_name) = 'gdrv.sys' AND activity_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Find the creation of gdrv.sys, used by the attacker to disable security software.", "expected_signal": "A row identifying the host and path where gdrv.sys was dropped. Silence is evidence of absence for this specific driver name." }, "parents": [ { "id": "windows-host-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "BYOVD driver drop", "reads": [ "device_hostname", "file_name", "file_path", "time", "activity_id" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND LOWER(file_name) = 'gdrv.sys' AND activity_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "A row identifying the host and path where gdrv.sys was dropped. Silence is evidence of absence for this specific driver name.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "launcher-execution-search", "type": "query", "label": "Settra launcher execution", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, parent_process_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%_win64.exe' OR LOWER(process_cmd_line) LIKE '%_win64.exe') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify the execution of the Settra launcher, which is typically named after the domain name.", "expected_signal": "Processes identifying the launcher, user context, and host. Naming a binary after a domain string is a specific Settra pattern." }, "parents": [ { "id": "windows-host-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Settra launcher execution", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, parent_process_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) LIKE '%_win64.exe' OR LOWER(process_cmd_line) LIKE '%_win64.exe') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Processes identifying the launcher, user context, and host. Naming a binary after a domain string is a specific Settra pattern.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "early-stage-agent", "type": "analytic", "label": "Early stage triage", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "byovd-driver-search", "launcher-execution-search" ], "objective": "Decide if the combination of gdrv.sys and a domain-named binary indicates an active Settra ransomware attempt on any host.", "description": "Assess whether the driver drop and launcher execution on the same host indicate the start of a Settra ransomware incident.", "max_iterations": 4, "expected_signal": "A per-host verdict of suspicious or malicious if indicators align.", "success_criteria": "A verdict citing specific hosts and rows where both indicators align." }, "parents": [ { "id": "byovd-driver-search", "kind": "merge" }, { "id": "launcher-execution-search", "kind": "merge" } ] }, { "id": "anti-recovery-baseline", "type": "query", "label": "Rare anti-recovery commands", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND (LOWER(process_cmd_line) LIKE '%reagentc% /disable%' OR LOWER(process_cmd_line) LIKE '%cipher% /w:%' OR LOWER(process_cmd_line) LIKE '%wevtutil% cl %' OR LOWER(process_cmd_line) LIKE '%diskpart% /s %') AND LOWER(process_cmd_line) IN (SELECT LOWER(process_cmd_line) FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%reagentc% /disable%' OR LOWER(process_cmd_line) LIKE '%cipher% /w:%' OR LOWER(process_cmd_line) LIKE '%wevtutil% cl %' OR LOWER(process_cmd_line) LIKE '%diskpart% /s %') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_cmd_line) HAVING COUNT(DISTINCT device_hostname) < 3)", "surface": "hb_process_activity", "description": "Find individual events of recovery inhibition commands that are rare across the fleet.", "expected_signal": "A list of hosts running these commands where the activity is rare across the fleet. This allows pinning the behavior to a specific timeline and host identity." }, "parents": [ { "id": "early-stage-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare anti-recovery commands", "reads": [ "device_hostname", "user_name", "process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') AND (LOWER(process_cmd_line) LIKE '%reagentc% /disable%' OR LOWER(process_cmd_line) LIKE '%cipher% /w:%' OR LOWER(process_cmd_line) LIKE '%wevtutil% cl %' OR LOWER(process_cmd_line) LIKE '%diskpart% /s %') AND LOWER(process_cmd_line) IN (SELECT LOWER(process_cmd_line) FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%reagentc% /disable%' OR LOWER(process_cmd_line) LIKE '%cipher% /w:%' OR LOWER(process_cmd_line) LIKE '%wevtutil% cl %' OR LOWER(process_cmd_line) LIKE '%diskpart% /s %') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_cmd_line) HAVING COUNT(DISTINCT device_hostname) < 3)", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of hosts running these commands where the activity is rare across the fleet. This allows pinning the behavior to a specific timeline and host identity.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-09-23" } }, { "id": "encryption-artifact-search", "type": "query", "label": "Encrypted files and ransom notes", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_name) LIKE '%.locked%' OR LOWER(file_name) = 'restore_files.txt') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Find the final evidence of encryption by searching for specific file extensions and the ransom note.", "expected_signal": "Files renamed with .locked or .locked_wip extensions, or the creation of RESTORE_FILES.txt." }, "parents": [ { "id": "early-stage-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Encrypted files and ransom notes", "reads": [ "device_hostname", "file_name", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_name) LIKE '%.locked%' OR LOWER(file_name) = 'restore_files.txt') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Files renamed with .locked or .locked_wip extensions, or the creation of RESTORE_FILES.txt.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "impact-assessment-agent", "type": "analytic", "label": "Final impact assessment", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-agent", "anti-recovery-baseline", "encryption-artifact-search" ], "objective": "Confirm if any host shows a complete Settra ransomware attack chain, from launcher execution and driver drop to recovery inhibition and file encryption.", "description": "Analyze all gathered evidence to determine if a Settra ransomware incident is confirmed.", "max_iterations": 5, "expected_signal": "A comprehensive verdict correlating the launcher, driver, and impact.", "success_criteria": "A final verdict citing specific hosts where early indicators and follow-on impacts overlap." }, "parents": [ { "id": "anti-recovery-baseline", "kind": "merge" }, { "id": "encryption-artifact-search", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "The impact assessment confirms that early-stage indicators (driver or launcher) on a host are followed by successful anti-recovery commands and file encryption.", "condition": "The impact assessment confirms that early-stage indicators (driver or launcher) on a host are followed by successful anti-recovery commands and file encryption.", "blind_spot": "endpoint-telemetry-gap", "confidence": "high", "description": "Direct the workflow based on the agent's findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "impact-assessment-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Halt the ransomware encryption process and prevent further spread.", "instructions": "Isolate the confirmed compromised endpoint immediately to prevent further file encryption. Preserve the system state for forensic analysis; do not reboot unless necessary.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst incident review", "config": { "assignee": "analyst", "description": "Review the evidence findings and coordinate recovery.", "instructions": "Review the cited rows for the launcher path and the anti-recovery commands. Verify the extent of the encryption via file system artifacts and check if any recovery partitions were successfully removed." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Finalize documentation and update detection rules.", "instructions": "Document the hunt findings and visibility gaps. If the launcher execution patterns were consistent, promote the domain-named binary detection to a permanent rule." }, "parents": [ { "id": "analyst-review" } ] } ] }