Selective Exclusion
This detection identifies adversaries employing selective exclusion during ransomware or destructive payload execution, where specific file extensions, directories, or system components are deliberately skipped to maintain system stability, evade detection, and ensure ransom delivery. Key indicators include script interpreter processes enumerating files with extensive system extension exclusion lists (.dll, .exe, .lnk, .sys, .msi), command-line arguments embedding regex patterns targeting multiple Windows critical extensions, explicit PowerShell exclusion operators (-notmatch, -notlike, -notcontains) filtering system file types, and mass file operation patterns that selectively skip binary and system formats. Ransomware families including Medusa, Embargo, and InvisibleFerret employ this technique to avoid system instability while maximizing encryption coverage, ensuring the victim endpoint remains operational enough to display ransom demands.
DeviceProcessEvents
| where TimeGenerated > ago(1h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "cmd.exe", "mshta.exe")
| where ProcessCommandLine matches regex @"(?i)(\.(dll|exe|lnk|sys|msi|bat|cmd|ini|url|drv|ocx|pif|com).*){3,}"
or ProcessCommandLine matches regex @"(?i)(exclu|skip|avoid|ignore|bypass).{0,60}\.(dll|exe|lnk|sys|msi)"
or ProcessCommandLine matches regex @"(?i)(-notmatch|-notlike|-notcontains|-notin|-ne).{0,80}\.(dll|exe|lnk|sys)"
| extend ExtensionCount = array_length(extract_all(@"(?i)\.(dll|exe|lnk|sys|msi|bat|cmd|ini|url|drv|ocx|pif|com)", ProcessCommandLine))
| where ExtensionCount >= 3
| extend ExclusionIndicatorType = case(
ProcessCommandLine matches regex @"(?i)(exclu|skip|avoid|ignore|bypass)", "ExplicitExclusionKeyword",
ProcessCommandLine matches regex @"(?i)(-notmatch|-notlike|-notcontains|-notin)", "PowerShellExclusionOperator",
ProcessCommandLine matches regex @"(?i)(\.(dll|exe|lnk|sys|msi).*){4,}", "MultipleSystemExtensions",
"Other"
)
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ExtensionCount, ExclusionIndicatorType
| order by ExtensionCount descData Sources
Required Tables
False Positives
- Legitimate backup agent scripts (Veeam, Commvault, Veritas) that enumerate file systems while excluding binary extensions from backup scope
- Software deployment automation (SCCM, PDQ Deploy, Ansible) that iterates files while targeting specific document types and skipping executables
- IT administration PowerShell scripts performing selective file operations during maintenance windows
- Security scanner scripts that explicitly exclude certain file types from scanning scope to reduce load
- Developer build and packaging scripts that process source files while explicitly skipping compiled outputs (.exe, .dll)
References (5)
- https://attack.mitre.org/techniques/T1679/
- https://unit42.paloaltonetworks.com/medusa-ransomware-january-2024/
- https://www.esentire.com/blog/contagious-interview-north-korean-threat-actors-delivering-new-invisibleferret-malware
- https://www.cyble.com/blog/embargo-ransomware-a-new-multi-extortion-group/
- https://www.microsoft.com/en-us/security/blog/2024/05/28/ransomware-as-a-service-the-threat-actors-behind-medusa/
Unlock Pro Content
Get the full detection package for T1679 including response playbook, investigation guide, and atomic red team tests.