Ransomware Prevention
Go based Ransomware/Malware
BlackCat
RobbinHood
Nefilim
EKANS
Zebrocy - Russian state-sponsored group APT28 created a Go-based version of their Zebrocy malware last year.
WellMess - Russian state-sponsored group APT29 deployed new upgraded versions of their Go-based WellMess malware last year.
Godlike12 - A Chinese state-sponsored group deployed Go-based backdoors for attacks on the Tibetan community last year.
Go Loader - The China-linked Mustang Panda APT deployed a new Go-based loader last year for their attacks.
GOSH - The infamous Carbanak group deployed a new RAT named GOSH written in Go last August.
Glupteba - New versions of the Glupteba loader were seen in 2020, more advanced than ever.
Nim based Ransomware/Malware
Rust based Ransomware/Malware
Buer
Dlang based Ransomware/Malware
C
C++
.NET
C#
Java
Objective-c
Python
Perl
Javascript
Powershell
WebAssembly
Delphi
RAT (Remote Access Trojans)
Cobalstrike
Remcos
Nanocore
Crypto Miners
Data exfiltration
Rclone
7zip
Malicious behavior
deleting backups and logs
Changing firewall
Azure Credentials
Which programming languages are hard to reverse engineer
Analyzing ELF files and PE
Win32 API's
References:
https://unit42.paloaltonetworks.com/blackcat-ransomware/
https://www.trendmicro.com/vinfo/us/security/definition/Ransomware
https://github.com/redcode-labs/Neurax
https://github.com/redcode-labs/Coldfire
https://github.com/ponty/pyscreenshot
Wazuh
- HIDS
- OSSEC
MISP
- Threat Intellegence
Zeek/Suricata/Snort
- IDS/IPS
PFSense
- Firewall
Perimeter security logs collected from PFsense and Zeek (span port )
using file beat to forward data to Elkstack(log stash)
AD/DC
- Winlog Beat
- Metric Beat
Linux server
- Audit Beat
- Metric Beat
- File Beat
SOAR
- The Hive
Siemplify
SoC Architectures
Log Collection
Log Parsing
Events
Threat Intel (ingest)
Threat detection
Alerts
Threat investigation
Incident Response
Forensics
Netflow
Switch spanport -> zeek ids - different logs
Switch spanport -> suricata -> json (Event.log)
Switch spanport -> Moloch/arkime -> pcap
NSM distribution
Security onion
SELKS
CAPESStack
HELK
ROCK NSM
Host Data collections
Event Generation
OSSEC
Sysdig for container security
Windows sysinternals
sysmon
Osquery
Wazuh
Data Shippers/aggregators
Beats
Filebeat
Winlogbeat
Audit beat
Packetbeat
Journalbeat
Functionbeat
Heartbeat
DIY beats
LogStash
Nxlog
Fluentd
Nifi
SIEM
Graylog
Apache metron
Alien vault
Sigma
Jupyter
Sguil
Evebox
Incident management
TheHive
Sigma
Preparation:
Offline backups availability and integrity check
Maintain and Audit golden images and build templates
Use of Infrastructure as a code to deploy images
Manage IaC in versions for audit purpose
Storing application source code or executables as backup
Removing and replacing outdated hardware
Using multi cloud solutions and maintaining cloud backups, using immutable storage solutions
Audit cloud environment
Develop and audit incident response, communication and breach notification plan
Develop Cyber incident response playbook
Build and implement Zero Trust Architecture
Prevention and Mitigating:
Develop surface discovery plan and audit attack finding
Monitor deep web notification/credential monitoring services
Periodical vulnerability Scans (review CISA Know vulnerability list)
External
Internal
VPN Infra
Periodical patch management
Assets security
BYOD
All devices on hybrid infrastructure
Protocol, port and service usage metrics
RDP
Have visibility to configuration and change management
Implement MFA
Disable weak protocols
SMB v 1 and v 2
Audit SMB traffic
Implement SMB signing and audit
Blocking external access
SMB
TCP 445
UDP 137
UDP 138
TCP 139
Implement SMB encryption with Universal Naming Convention (UNC) hardening
Log and monitor SMB and RDP traffic
Initial Access:
Implement
Phishing resistant MFA and password less MFA
IAM
PAM
Change default creds
Restrict use of root or system admin users s
Password minimum length and policies
Password rotation
Password management tools
Failed login attempts metrics and audit
Disabling saving passwords to browser using Group Policy
Local Administrator Password solution (LAPS)
LSASS : implement attack surface reduction rule
Windows credential guard
Use Windows PowerShell Remoting, Remote Credential Guard, or RDP with restricted
Admin Mode
Separation of admin and user accounts
Conduct security awareness training
Email attachments known bad
Disable office macros
Disable Windows Script Host (WSH)
Review malware infections
Ex: s QakBot, Bumblebee, and Emotet
Phishing email metrics and BEC scams
How many blocked
How many bypassed
EDR implementation
Windows Defender Application Control (WDAC), AppLocker
Application allow listing
Implement of EDR on cloud
Threat intel and feed into security stack
Security awareness training
Protective DNS
Sandboxed browsers
Monitor
Seo poisoning
Drive by download
Malvertising
Restricting PowerShell usage and alerts
Keywords:
CISA
MSISAC
FBI IC3
NSA
ZTA
References:
download: https://ofac.treasury.gov/media/912981/download?inline
Stop Ransomware | CISA: https://www.cisa.gov/stopransomware
Cross-Sector Cybersecurity Performance Goals | CISA: https://www.cisa.gov/cross-sector-cybersecurity-performance-goals
Public-Power-Cyber-Incident-Response-Playbook.pdf: https://www.publicpower.org/system/files/documents/Public-Power-Cyber-Incident-Response-Playbook.pdf
Zero Trust Maturity Model | CISA: https://www.cisa.gov/zero-trust-maturity-model
CSI-MITIGATING-CLOUD-VULNERABILITIES_20200121.PDF: https://media.defense.gov/2020/Jan/22/2002237484/-1/-1/0/CSI-MITIGATING-CLOUD-VULNERABILITIES_20200121.PDF
KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS) - Microsoft Support: https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429
Overview of Server Message Block signing - Windows Server | Microsoft Learn: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing
Manage Windows Defender Credential Guard (Windows) | Microsoft Learn: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage
Exchange Online Protection feature details - Service Descriptions | Microsoft Learn: https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-protection-service-description/exchange-online-protection-feature-details?tabs=Anti-spam-and-anti-malware-protection
CISA Insights - Cyber: Enhance Email & Web Security: https://www.cisa.gov/sites/default/files/publications/CISAInsights-Cyber-EnhanceEmailandWebSecurity_S508C-a.pdf
How DMARC Advances Email Security: https://www.cisecurity.org/insights/blog/how-dmarc-advances-email-security
Malicious Domain Blocking and Reporting (MDBR): https://www.cisecurity.org/ms-isac/services/%20mdbr
Macros from the internet are blocked by default in Office - Deploy Office | Microsoft Learn: https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
CSI_Selecting a Protective DNS Service_U00117652-21.PDF: https://media.defense.gov/2021/Mar/03/2002593055/-1/-1/1/CSI_Selecting%20a%20Protective%20DNS%20Service_U00117652-21.PDF
Microsoft Office 365 Security Recommendations | CISA: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-120a
csi_keeping_powershell_security_measures_to_use_and_embrace_20220622.pdf: https://media.defense.gov/2022/jun/22/2003021689/-1/-1/1/csi_keeping_powershell_security_measures_to_use_and_embrace_20220622.pdf
Best Practices for Securing Active Directory | Microsoft Learn: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
BloodHound, Software S0521 | MITRE ATT&CK®: https://attack.mitre.org/versions/v13/software/S0521/
Securing Active Directory Administrative Groups and Accounts | Microsoft Learn: https://learn.microsoft.com/en-us/previous-versions/tn-archive/cc700835(v=technet.10)?redirectedfrom=MSDN
Albert Network Monitoring and Management: https://www.cisecurity.org/services/albert-network-monitoring
KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS) - Microsoft Support: https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429
download: https://ofac.treasury.gov/media/912981/download?inline
6 Incident Response Steps to Take After a Security Event: https://www.exabeam.com/incident-response/steps/
https://www.malware.us-cert.gov: https://www.malware.us-cert.gov/
Election Security Spotlight – Malware Analysis: https://www.cisecurity.org/insights/spotlight/cybersecurity-spotlight-malware-analysis
Last updated