Ransomware Prevention

Go based Ransomware/Malware

• BlackCat

• RobbinHood

• Nefilim

• EKANS

• Zebrocy - Russian state-sponsored group APT28 created a Go-based version of their Zebrocy malware last year.

• WellMess - Russian state-sponsored group APT29 deployed new upgraded versions of their Go-based WellMess malware last year.

• Godlike12 - A Chinese state-sponsored group deployed Go-based backdoors for attacks on the Tibetan community last year.

• Go Loader - The China-linked Mustang Panda APT deployed a new Go-based loader last year for their attacks.

• GOSH - The infamous Carbanak group deployed a new RAT named GOSH written in Go last August.

• Glupteba - New versions of the Glupteba loader were seen in 2020, more advanced than ever.

Nim based Ransomware/Malware

Rust based Ransomware/Malware

• Buer

Dlang based Ransomware/Malware

C

C++

.NET

C#

Java

Objective-c

Python

Perl

Javascript

Powershell

WebAssembly

Delphi

RAT (Remote Access Trojans)

• Cobalstrike

• Remcos

• Nanocore

Crypto Miners

Data exfiltration

• Rclone

• 7zip

Malicious behavior

• deleting backups and logs

• Changing firewall

• Azure Credentials

Which programming languages are hard to reverse engineer

Analyzing ELF files and PE

Win32 API's

References:

https://unit42.paloaltonetworks.com/blackcat-ransomware/

https://www.trendmicro.com/vinfo/us/security/definition/Ransomware

https://github.com/redcode-labs/Neurax

https://github.com/redcode-labs/Coldfire

https://github.com/ponty/pyscreenshot

Wazuh

- HIDS

- OSSEC

MISP

- Threat Intellegence

Zeek/Suricata/Snort

- IDS/IPS

PFSense

- Firewall

Perimeter security logs collected from PFsense and Zeek (span port )

using file beat to forward data to Elkstack(log stash)

AD/DC

- Winlog Beat

- Metric Beat

Linux server

- Audit Beat

- Metric Beat

- File Beat

SOAR

- The Hive

Siemplify

SoC Architectures

Log Collection

Log Parsing

Events

Threat Intel (ingest)

Threat detection

Alerts

Threat investigation

Incident Response

Forensics

Netflow

Switch spanport -> zeek ids - different logs

Switch spanport -> suricata -> json (Event.log)

Switch spanport -> Moloch/arkime -> pcap

NSM distribution

• Security onion

• SELKS

• CAPESStack

• HELK

• ROCK NSM

Host Data collections

Event Generation

• OSSEC

• Sysdig for container security

• Windows sysinternals

• • sysmon

• Osquery

• Wazuh

Data Shippers/aggregators

• Beats

• • Filebeat

  • Winlogbeat

  • Audit beat

  • Packetbeat

  • Journalbeat

  • Functionbeat

  • Heartbeat

  • DIY beats

• LogStash

• Nxlog

• Fluentd

• Nifi

SIEM

Graylog

Apache metron

Alien vault

Sigma

Jupyter

Sguil

Evebox

Incident management

TheHive

Sigma

Preparation:

• Offline backups availability and integrity check

• Maintain and Audit golden images and build templates

• Use of Infrastructure as a code to deploy images

• Manage IaC in versions for audit purpose

• Storing application source code or executables as backup

• Removing and replacing outdated hardware

• Using multi cloud solutions and maintaining cloud backups, using immutable storage solutions

• Audit cloud environment

• Develop and audit incident response, communication and breach notification plan

• Develop Cyber incident response playbook

• Build and implement Zero Trust Architecture

Prevention and Mitigating:

• Develop surface discovery plan and audit attack finding

• • Monitor deep web notification/credential monitoring services

• Periodical vulnerability Scans (review CISA Know vulnerability list)

• • External

  • Internal

  • VPN Infra

• Periodical patch management

• Assets security

• • BYOD

  • All devices on hybrid infrastructure

• Protocol, port and service usage metrics

• • RDP

• Have visibility to configuration and change management

• Implement MFA

• Disable weak protocols

• • SMB v 1 and v 2

  • Audit SMB traffic

  • Implement SMB signing and audit

• Blocking external access

• • SMB

  • • TCP 445

    • UDP 137

    • UDP 138

    • TCP 139

  • Implement SMB encryption with Universal Naming Convention (UNC) hardening

  • Log and monitor SMB and RDP traffic

Initial Access:

• Implement

• • Phishing resistant MFA and password less MFA

  • IAM

  • PAM

• Change default creds

• Restrict use of root or system admin users s

• Password minimum length and policies

• • Password rotation

  • Password management tools

• Failed login attempts metrics and audit

• Disabling saving passwords to browser using Group Policy

• Local Administrator Password solution (LAPS)

• LSASS : implement attack surface reduction rule

• Windows credential guard

• Use Windows PowerShell Remoting, Remote Credential Guard, or RDP with restricted

Admin Mode

• Separation of admin and user accounts

• Conduct security awareness training

• Email attachments known bad

• Disable office macros

• Disable Windows Script Host (WSH)

• Review malware infections

• • Ex: s QakBot, Bumblebee, and Emotet

• Phishing email metrics and BEC scams

• • How many blocked

  • How many bypassed

• EDR implementation

• • Windows Defender Application Control (WDAC), AppLocker

  • Application allow listing

  • Implement of EDR on cloud

• Threat intel and feed into security stack

• Security awareness training

• Protective DNS

• Sandboxed browsers

• Monitor

• • Seo poisoning

  • Drive by download

  • Malvertising

• Restricting PowerShell usage and alerts

Keywords:

CISA

MSISAC

FBI IC3

NSA

ZTA

References:

download: https://ofac.treasury.gov/media/912981/download?inline

Stop Ransomware | CISA: https://www.cisa.gov/stopransomware

Cross-Sector Cybersecurity Performance Goals | CISA: https://www.cisa.gov/cross-sector-cybersecurity-performance-goals

Public-Power-Cyber-Incident-Response-Playbook.pdf: https://www.publicpower.org/system/files/documents/Public-Power-Cyber-Incident-Response-Playbook.pdf

Zero Trust Maturity Model | CISA: https://www.cisa.gov/zero-trust-maturity-model

CSI-MITIGATING-CLOUD-VULNERABILITIES_20200121.PDF: https://media.defense.gov/2020/Jan/22/2002237484/-1/-1/0/CSI-MITIGATING-CLOUD-VULNERABILITIES_20200121.PDF

KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS) - Microsoft Support: https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429

Overview of Server Message Block signing - Windows Server | Microsoft Learn: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing

Manage Windows Defender Credential Guard (Windows) | Microsoft Learn: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage

Exchange Online Protection feature details - Service Descriptions | Microsoft Learn: https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-protection-service-description/exchange-online-protection-feature-details?tabs=Anti-spam-and-anti-malware-protection

CISA Insights - Cyber: Enhance Email & Web Security: https://www.cisa.gov/sites/default/files/publications/CISAInsights-Cyber-EnhanceEmailandWebSecurity_S508C-a.pdf

How DMARC Advances Email Security: https://www.cisecurity.org/insights/blog/how-dmarc-advances-email-security

Malicious Domain Blocking and Reporting (MDBR): https://www.cisecurity.org/ms-isac/services/%20mdbr

Macros from the internet are blocked by default in Office - Deploy Office | Microsoft Learn: https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked

CSI_Selecting a Protective DNS Service_U00117652-21.PDF: https://media.defense.gov/2021/Mar/03/2002593055/-1/-1/1/CSI_Selecting%20a%20Protective%20DNS%20Service_U00117652-21.PDF

Microsoft Office 365 Security Recommendations | CISA: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-120a

csi_keeping_powershell_security_measures_to_use_and_embrace_20220622.pdf: https://media.defense.gov/2022/jun/22/2003021689/-1/-1/1/csi_keeping_powershell_security_measures_to_use_and_embrace_20220622.pdf

Best Practices for Securing Active Directory | Microsoft Learn: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory

BloodHound, Software S0521 | MITRE ATT&CK®: https://attack.mitre.org/versions/v13/software/S0521/

Securing Active Directory Administrative Groups and Accounts | Microsoft Learn: https://learn.microsoft.com/en-us/previous-versions/tn-archive/cc700835(v=technet.10)?redirectedfrom=MSDN

Albert Network Monitoring and Management: https://www.cisecurity.org/services/albert-network-monitoring

KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS) - Microsoft Support: https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429

download: https://ofac.treasury.gov/media/912981/download?inline

6 Incident Response Steps to Take After a Security Event: https://www.exabeam.com/incident-response/steps/

https://www.malware.us-cert.gov: https://www.malware.us-cert.gov/

Election Security Spotlight – Malware Analysis: https://www.cisecurity.org/insights/spotlight/cybersecurity-spotlight-malware-analysis