CryptoLocker Prevention

[halbaradkenafin]

[h=1]CryptoLocker Prevention[/h]

This document will cover the various safeguards that have been put in place to prevent, or limit the effects of, Cryptolocker and its variants in their current forms. It will be updated as best as possible as new strains are discovered and researched by the wider security community. As the severity of a Crypto* infection is very high it’s necessary to use a multi-layered approach to protecting the network, this includes a GPO for software restriction policies, file screen rules for executable files and a file screen rule for the “ransom” files that are created should it get through the other layers.

 

[h=2]Software Restriction Policy GPO[/h]

The primary delivery methods of Crypto*, for the currently known variants, is either via email attachment (zip files or macros in Office documents mostly) or via Flash ads/banners on websites. Most of these methods will not actually contain the Crypto* executable itself but will download it from some central site (or sites) that it’s hosted on, this is primarily to get around the blocking of exe files in emails and attachments that almost every email provider does as standard. This means that the exe will almost always try to run from either the temp directory or the appdata directory, to combat this the following Software Restriction Policies are in place to apply to all computers on the network:

 

Set to Disallowed:

 

%appdata%*.exe

%appdata%*.bat

%appdata%*.ps1

%Application Data%*.exe

%Application Data%*.bat

%Application Data%*.ps1

%temp%*.exe

%temp%*.bat

%temp%*.ps1

%temp%*.zip*.exe

%temp%\7z\*.exe

%temp%\rar\*.exe

%temp%\wz\*.exe

%userprofile%*.bat

%userprofile%*.exe

%userprofile%*.ps1

 

This should cover the primary locations (and aliases) that the exes can run from.

 

A more restrictive policy would be to prevent any executables outside the Windows and Program Files directories running, or to use AppLocker to further limit what end users can run. We currently don’t implement either of these options but they should be considered for investigation in the future to improve the security of the network.

 

[h=2]File Screen Rules – Executables[/h]

These file screen rules are primarily to prevent users from saving various executable files to the network drives but have the added benefit of also limiting Crypto*’s impact, particularly in cases where users may save untrusted files from any external drives they have or emails they receive.

 

To configure the File Screens, open File Server Resource Manager (fsrm.msc) and configure the File Screen Template for the Block Executable Files template. By default it is already mostly configured but some modifications can be made, such as setting the email address to send notification emails. Once that is configured it’s necessary to assign the template to a location, right click File Screens and choose “Create File Screen”. Choose the path you want to assign it to, choose the template to use (“Block Executable Files”) and click create.

 

We currently have two in place on each file server, one at the root of the Shared drive folder (Staff Shared and Student Shared) and one at the root of each user drive folder (Staff Users and Student Users). If you use separate folders for the profile and home folders of the users and they aren’t stored within another folder, such as D:\Staff\Home and D:\Staff\Profile or similar, then you’ll need to create a File Screen for each folder.

 

[h=2]File Screen Rules – Ransom Files[/h]

As part of Crypto*’s encryption process it creates some text files in the folders it encrypts to let the user know how to recover their files, at the cost of a few bit coins usually. The actual encryption of the files can’t be detected directly once it’s started (other than trying to open an encrypted file) but the creation of these files can be detected using File Screen Rules.

 

The process for creating a new File Group is very straight forward, though a little long winded when specifying more than a few file names. There is a short Powershell command below that will create the file group for you with all the keywords I’ve found so far. Ensure you give it a meaningful name, I use “Cryptolocker Variants”.

 

New-FSRMFileGroup –Name “Cryptolocker Variants” –IncludePattern @(”*.*AES256”,”*.*cry”,”*.*crypto”,”*.*darkness”,”*.*enc”,”*.*encrypted”,”*.*exx”,”*.*kb15”,”*.*kraken”,”*.*locked”,”*.*nochance”,”*.*oshit”,”*@gmail_com_*”,”*@india.com*”,”*cpyt*”,”*crypt*”,”*decipher*”,”*install_tor*.*”,”*keemail.me*”,”*qq_com*”,”*ukr.net*”,”*.*enc*”,”*restore_fi*.*”,”*help_restore*.*”,”*how_to_recover*.*”,”*.ecc”,”*.exx”,”*.ezz”,”*.frtrss”,”*.vault”,”*want your files back.*”,”confirmation.key”,”enc_files.txt”,”last_chance.txt”,”recovery_file.txt”,”recovery_key.txt”,”
vault.hta”,”vault.key”,”vault.txt”,”*.aaa”,”help_restore*.*”,”how_to_recover*.*”,” install_tor*.*”)

Once the file group is created you need to create a File Screen Template, right click the File Screen Templates and choose “Create File Screen Template”. Give it a meaningful name, tick the box for “Cryptolocker Variants” (or whatever you named yours) within the File Groups box. On the Email Message tab set an email address to send to and update the Email Message as you see fit, the one we use is:

 

Possible Cryptolocker Infection

 

User [source Io Owner] attempted to save [source File Path] to [File Screen Path] on the [server] server. This file is in the [Violated File Group] file group, which is not permitted on the server.

 

This will give us a short email with the full path and user who tried to save the ransom file.

 

On the Command tab tick the box for running a command and browse to the location of Powershell.exe (C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe) and within the Command Arguments box type:

 

-command &{C:\Disconnect-SMBShares.ps1 -username '[source Io Owner]'}

 

Change the path of the ps1 file to wherever you decide to save the file. I’ve set the command to run as Local System to ensure the minimal amount of permissions problems.

 

With that done click Okay and create a File Screen to apply that template to the root of the drive holding your shares, or multiple if they are spread across many drives.

 

The last thing that needs to be doing is adding in the credentials for the script to use when contacting other file servers. This can be handled one of two ways; either specify the credentials directly in the PowerShell file (not recommended) or encrypt the password in another file and access it in the script (how it currently functions).

 

For specifying the credentials in the PowerShell script modify the $Pass variable to the following:

 

 
[i]$pass = “PasswordHere” | ConvertTo-SecureString –AsPlainText –Force[/i]

 

For encrypting the password in another file then run the following from a PowerShell prompt while logged in as the user who the script will run as (Domain Admin preferred but anyone who can successfully run the Block-SMBShareAccess command on file servers).

 

 
[i]“Passwordhere” | ConvertTo-SecureString –AsPlainText –Force | ConvertFrom-SecureString | Out-File “C:\File.ini”[/i]

 

Change the file.ini to wherever you wish to store the password file and update the script to point to the same location. It’s necessary to do this as the user specified in the script due to the way PowerShell handles SecureString values and their encryption, they can only be correctly decrypted and used by that specific user on that specific machine.

 

 

Once this is completed it’s worth testing this using one of your test accounts, create a file that contains the word “crypto” in its name and you should then receive and email and find that user’s access to the server has been blocked. If you’re satisfied that the process works correctly then repeat this process for each file server you have.

 

 

NOTE: Both the following scripts will need to be modified to match your environment, if you've got less file servers (or servers with shares on them) then remove the extra Invoke-Commands, if you've got more then duplicate them and change the names.

 

Disconnect-SMBShares.ps1

 

<#
.Synopsis
  Removes a users access to all network shares from file and app servers
.DESCRIPTION
  This script will remove all access a user has to the SMB shares from the 
  file and app servers and is run as part of the cryptolocker mitigation 
  structure by the FSRM passive rule when detecting the decrypt.txt files 
  (and variants).


.EXAMPLE
  .\Disconnect-SMBShares.ps1 -Username "Bloggs.J"


  This will remove access to all SMB shares for bloggs.j
#>
param(
   [string]$username = ""
)


$ShareDescription = ("Remote Admin","Remote IPC","Default Share")
$Pass = Get-Content C:\File.ini | ConvertTo-SecureString
$Cred = new-object -typename System.Management.Automation.PSCredential -argumentlist "wsh\administrator",$pass 
if ($env:computername -eq "Fileserver01")
{
   Get-SmbShare | Where { $ShareDescription -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Block-SmbShareAccess -AccountName $username -Confirm:$false


   invoke-command -ComputerName "Fileserver02" -Credential $Cred -scriptblock {Get-SmbShare  |  Where { $Using:ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Block-SmbShareAccess -AccountName $using:username -Confirm:$false}


   invoke-command -ComputerName "AppServer01" -Credential $Cred -scriptblock {Get-SmbShare  |  Where { $Using:ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Block-SmbShareAccess -AccountName $using:username -Confirm:$false}




}
elseif ($env:computername -eq "FileServer02")
{


   Get-SmbShare |  Where { $ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Block-SmbShareAccess -AccountName $username -Confirm:$false


   invoke-command -ComputerName "FileServer01" -Credential $Cred -scriptblock {Get-SmbShare  | Where { $Using:ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Block-SmbShareAccess -AccountName $using:username -Confirm:$False}


   invoke-command -ComputerName "AppServer01" -Credential $Cred -scriptblock {Get-SmbShare  |  Where { $Using:ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Block-SmbShareAccess -AccountName $using:username -Confirm:$false}


}
elseif ($env:computername -eq "AppServer01")
{


   Get-SmbShare |  Where { $ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Block-SmbShareAccess -AccountName $username -Confirm:$false


   invoke-command -ComputerName "FileServer01" -Credential $Cred -scriptblock {Get-SmbShare  |  Where { $Using:ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Block-SmbShareAccess -AccountName $using:username -Confirm:$false}


   invoke-command -ComputerName "FileServer02" -Credential $Cred -scriptblock {Get-SmbShare  |  Where { $Using:ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Block-SmbShareAccess -AccountName $using:username -Confirm:$false}


}

 

Connect-SMBShare.ps1

This is the script I run after I've investigated the possible infection and am sure that it's cleaned up completely. In the case of a real infection (which I haven't had yet thankfully) I'd reimge the PC, restore from Shadow Copies or other back ups any effected files (and probably a folder or two around them just to be sure). This doesn't have to be run from a server and can just be run for any PC with Powershell, but it does need sufficient credentials to actually make the changes to the fileserver permissions.

 

<#
.Synopsis
  Returns a users access to all network shares from file and app servers
.DESCRIPTION
  This script will return all access a user has to the SMB shares from the 
  file and app servers and is run as part of the recovery from cryptolocker.


  This should only be used after the effected PC has been removed from the
  network and rebuilt, and the effected files restored using Shadow Copies or
  other backups.


.EXAMPLE
  .\Connect-SMBShares.ps1 -Username "Bloggs.J"


  This will Return access to all SMB shares for bloggs.j
#>


param(
   [Parameter(Mandatory=$True)]
   [string]$username
)




$ShareDescription = ("Remote Admin","Remote IPC","Default Share")
$Cred = Get-Credential
invoke-command -computername "Fileserver01" -Credential $Cred -ScriptBlock {Get-SmbShare | Where { $Using:ShareDescription -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Unblock-SmbShareAccess -AccountName $Using:username -Confirm:$false}


invoke-command -ComputerName "FileServer02" -Credential $Cred -scriptblock {Get-SmbShare  |  Where { $Using:ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Unblock-SmbShareAccess -AccountName $using:username -Confirm:$false}


invoke-command -ComputerName "AppServer01" -Credential $Cred -scriptblock {Get-SmbShare  |  Where { $Using:ShareDescription  -notcontains $_.Description -and $_.Name -ne "MTATempStore$"} | Unblock-SmbShareAccess -AccountName $using:username -Confirm:$false}

 

Sources:

 

Generally helpful info: Stop CryptoLocker (and copy-cat variants of this badware) before it ruins your day - Samples - JPELECTRON.COM

Some more file screen keywords: File Screening List for Ransomware - Pastebin.com

Plus various comments on reddit.com/r/sysadmin when searching for cryptolocker

 

Improvements and suggestions are welcome.

Edited September 18, 2015 by elsiegee40

[DCUK6]

Nice guide, havnt read all of it yet but noticed something on the Software Restrictions and thought id post before i forget.

 

 

If you have Software Restrictions set to default on unrestricted or basic user and then disallow "%temp%*.exe" for example then if another folder is created so "%temp%\imabigvirus\*.exe" then this will still run.

 

 

There are two ways round it

Have million of policies for each new folder e.g:

%temp%*.exe

%temp%\*\*.exe

%temp%\*\*.exe

 

but this can be worked round pretty simply by creating one more folder than youve listed.

 

Second way is to set the Software Restriction Policy to be disabled by default and the specify places you allow rather than places you disallow stuff.

[halbaradkenafin]

Nice guide, havnt read all of it yet but noticed something on the Software Restrictions and thought id post before i forget.

 

 

If you have Software Restrictions set to default on unrestricted or basic user and then disallow "%temp%*.exe" for example then if another folder is created so "%temp%\imabigvirus\*.exe" then this will still run.

 

 

There are two ways round it

Have million of policies for each new folder e.g:

%temp%*.exe

%temp%\*\*.exe

%temp%\*\*.exe

 

but this can be worked round pretty simply by creating one more folder than youve listed.

 

Second way is to set the Software Restriction Policy to be disabled by default and the specify places you allow rather than places you disallow stuff.

 

That's a good point. It's something I've got to look into and narrow down where we've got stuff installed on our machines, I think the only thing not in Program Files or Windows is Python due to it's default install being in the root. It's on my list of things to look into fixing soon, and it's either that method or AppLocker. I'll probably go with the GPO option as it's a little easier to manage for both of us here (AppLocker is probably very easy to manage and has Powershell access but we've already got GPOs in place).

 

Edit: Skimming through our GPO again and it looks like we've got at least one which is %appdata%**.exe, no idea if that would work for nested folders though so I'll probably still give it try doing white listing rather than black listing.

Edited September 17, 2015 by halbaradkenafin

[DCUK6]

Just found this:

 

Blocking email attachments that users should'nt be receiving

Office 365 - Block Incoming Attachments (Cryptolocker and other email transit virus) - TechNet Articles - United States (English) - TechNet Wiki

 

 

• bat
  
• chm
  
• cmd
  
• com
  
• cpl
  
• crt
  
• exe
  
• hlp
  
• hta
  
• inf
  
• ...
  

Edited September 17, 2015 by DCUK6

[3s-gtech]

If you have Software Restrictions set to default on unrestricted or basic user and then disallow "%temp%*.exe" for example then if another folder is created so "%temp%\imabigvirus\*.exe" then this will still run.

 

 

There are two ways round it

Have million of policies for each new folder e.g:

%temp%*.exe

%temp%\*\*.exe

%temp%\*\*.exe

 

but this can be worked round pretty simply by creating one more folder than youve listed.

 

Second way is to set the Software Restriction Policy to be disabled by default and the specify places you allow rather than places you disallow stuff.

 

By setting EXE (and the others listed) as a Designated File Type it should be blocked, no matter how nested the folder is.

 

EDIT: just spotted a code quirk that may confuse some. Your command in FSRM states:

 

-command &{C:\Disconnect-SMBShares.ps1 -username '[source Io Owner]'}

 

but the name of the script in the post is Disconnect-SMBAccess.ps1

 

Otherwise all looking good - I've implemented some of these now as I'm pretty paranoid about it. Sadly FSRM can't email me using my Exchange box as it's hardened so won't work as an unauthenticated relay, and I lost many hours trying to get that working!

Edited September 17, 2015 by 3s-gtech

[halbaradkenafin]

EDIT: just spotted a code quirk that may confuse some. Your command in FSRM states:

 

-command &{C:\Disconnect-SMBShares.ps1 -username '[source Io Owner]'}

 

but the name of the script in the post is Disconnect-SMBAccess.ps1

 

Otherwise all looking good - I've implemented some of these now as I'm pretty paranoid about it. Sadly FSRM can't email me using my Exchange box as it's hardened so won't work as an unauthenticated relay, and I lost many hours trying to get that working!

 

Good spot, I'll report it to get it modified as I can't edit it anymore.

 

 

One thing I have noticed while doing some research on AppLocker is that it requires Win 7 Enterprise and won't work with Win 7 Pro. Something for people to bear in mind before investing lots of time in it.

 

I am currently experimenting with White listing SRP though instead, I've got two victims volunteers to try it out over the next week or so before I push it out to the whole school.

[elsiegee40]

By setting EXE (and the others listed) as a Designated File Type it should be blocked, no matter how nested the folder is.

 

EDIT: just spotted a code quirk that may confuse some. Your command in FSRM states:

 

-command &{C:\Disconnect-SMBShares.ps1 -username '[source Io Owner]'}

 

but the name of the script in the post is Disconnect-SMBAccess.ps1

 

Otherwise all looking good - I've implemented some of these now as I'm pretty paranoid about it. Sadly FSRM can't email me using my Exchange box as it's hardened so won't work as an unauthenticated relay, and I lost many hours trying to get that working!

 

Good spot, I'll report it to get it modified as I can't edit it anymore.

 

 

One thing I have noticed while doing some research on AppLocker is that it requires Win 7 Enterprise and won't work with Win 7 Pro. Something for people to bear in mind before investing lots of time in it.

 

I am currently experimenting with White listing SRP though instead, I've got two victims volunteers to try it out over the next week or so before I push it out to the whole school.

Corrected

[rrrrr]

 

Otherwise all looking good - I've implemented some of these now as I'm pretty paranoid about it. Sadly FSRM can't email me using my Exchange box as it's hardened so won't work as an unauthenticated relay, and I lost many hours trying to get that working!

 

Should be able to allow anonymous from only the ip address of your fsrm server

 

http://johanveldhuis.nl/file-server-resource-manager-client-does-not-have-permission-to-send-as-this-sender/

[Pyroman]

I'm doing some testing at the momenet with a test OU, dfault is unrestricted and i'm trying to add the restrictions as shown in OP. I'm getting confused, if I use %appdata%*.exe It doesn't block the exe from running. If I use %appdata% it does. What gives? Edited September 22, 2015 by Pyroman

[3s-gtech]

As I mentioned above, there shouldn't be a need to add the *.exe part, so long as you have .EXE as a Designated File Type in your SRPs. It does that bit for you, and saves you having to build nests of blocked folder.

[sonofsanta]

As I mentioned above, there shouldn't be a need to add the *.exe part, so long as you have .EXE as a Designated File Type in your SRPs. It does that bit for you, and saves you having to build nests of blocked folder.

 

So if you just add the folder path - e.g. %appdata& - it automatically disallows all the executable filetypes listed in the Designated File Types?

[Pyroman]

As I mentioned above, there shouldn't be a need to add the *.exe part, so long as you have .EXE as a Designated File Type in your SRPs. It does that bit for you, and saves you having to build nests of blocked folder.

 

Cheers, now if i could only get powershell working!

 

PS C:\> powershell.exe -ExecutionPolicy ByPass -file c:\crypto.ps1
The term 'New-FSRMFileGroup' is not recognized as the name of a cmdlet, function, script file, or operable program. Che
ck the spelling of the name, or if a path was included, verify that the path is correct and try again.
At C:\crypto.ps1:1 char:18
+ New-FSRMFileGroup <<<<  -Name "Cryptolocker Variants" -IncludePattern @("*.*AES256","*.*cry","*.*crypto","*.*darkness
","*.*enc","*.*encrypted","*.*exx","*.*kb15","*.*kraken","*.*locked","*.*nochance","*.*oshit","*@gmail_com_*","*@india.
com*","*cpyt*","*crypt*","*decipher*","*install_tor*.*","*keemail.me*","*qq_com*","*ukr.net*","*.*enc*","*restore_fi*.*
","*help_restore*.*","*how_to_recover*.*","*.ecc","*.exx","*.ezz","*.frtrss","*.vault","*want your files back.*","confi
rmation.key","enc_files.txt","last_chance.txt","recovery_file.txt","recovery_key.txt","
   + CategoryInfo          : ObjectNotFound: (New-FSRMFileGroup:String) [], CommandNotFoundException
   + FullyQualifiedErrorId : CommandNotFoundException

[Arthur]

Cheers, now if i could only get powershell working!

Try this...

 

New-FSRMFileGroup –Name "Cryptolocker Variants" –IncludePattern @("*.*AES256","*.*cry","*.*crypto","*.*darkness","*.*enc","*.*encrypted","*.*exx","*.*kb15","*.*kraken","*.*locked","*.*nochance","*.*oshit","*@gmail_com_*","*@india.com*","*cpyt*","*crypt*","*decipher*","*install_tor*.*","*keemail.me*","*qq_com*","*ukr.net*","*.*enc*","*restore_fi*.*","*help_restore*.*","*how_to_recover*.*","*.ecc","*.exx","*.ezz","*.frtrss","*.vault","*want your files back.*","confirmation.key","enc_files.txt","last_chance.txt","recovery_file.txt","recovery_key.txt","vault.hta","vault.key","vault.txt","*.aaa","help_restore*.*","how_to_recover*.*"," install_tor*.*")

 

@halbaradkenafin's PowerShell command includes an unnecessary line break.

[halbaradkenafin]

Obviously you'll need the FSRM role installed on the file server to also get the Powershell commands:

 

Install-WindowsFeature FS-Resource-manager -includemanagementtools

Edited September 22, 2015 by halbaradkenafin

[clockend25]

Implemented this but it only seems to wipe out the connections to the shares on the file server where the files are detected, as opposed to all of them. I'll have a look at it again later.

[Pyroman]

Obviously you'll need the FSRM role installed on the file server to also get the Powershell commands:

 

Instal-WindowsFeature FS-Resouce-manager -includemanagementtools

 

Ah, just done some googling. I'm still on Server 2008R2 and might need to use the filescrn.exe

[halbaradkenafin]

Implemented this but it only seems to wipe out the connections to the shares on the file server where the files are detected, as opposed to all of them. I'll have a look at it again later.

 

You need to add in your other servers using the Invoke-Command section, just duplicate it for the needed servers and update the names etc.

[clockend25]

Yeah done that but it's not having it. Most of the time with these things if I leave it a while and return for a fresh look I'll find a resolution.

[rrrrr]

To me, the protection against cryptolocker and other malware/viruses is a lot bigger than just SRP's. Viruses and malware have multiple attack vectors, with browser plugins being one of the most targeted (cryptolockers main infection path is adobe flash exploitation). SRP's are good protection but there doesn't seem to be much other than them mentioned in this thread. Below is my checklist I have put together on some other protection methods in order of importance to provide defence in depth.

 

Backups	Make sure all backups are regularly done and have adequate retention age.
Educate Staff	Make sure all staff are cautious on opening email attachments and links, and know what to look for
Patch OS and Plugins	Make sure all windows and browser updates are applied and any plugins are installed sparingly, and updated Check any old versions have been removed Cleanup Script Below on error resume next dim WshShell dim RegKey dim ScriptVerKey Set WshShell = CreateObject("WScript.Shell") 'checks to see if registry key exists, if it does, the cleanup runs. RegKey = "HKLM\SOFTWARE\EDU\Cleanup" ScriptVerKey = WshShell.RegRead(RegKey & "JAVAOldVer") if ScriptVerKey <> "1" Then Cleanup() Else WScript.Quit End If Sub Cleanup() ' Uninstall REM Uninstall Java 8 Update 51 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218051F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 51 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418051F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 45 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218045F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 45 - 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418045F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 31 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218031F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 31 - 32 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418031F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 25 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218025F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 25 - 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418025F0} /q",1,True ' Uninstall REM Java 7 Update 67 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F03217067FF} /q",1,True ' Uninstall REM Java 7 Update 60 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F03217060FF} /q",1,True ' Uninstall REM Java 7 Update 55 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217055FF} /q",1,True ' Uninstall REM Java 7 Update 51 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217051FF} /q",1,True ' Uninstall REM Java 7 Update 45 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217045FF} /q",1,True ' Uninstall REM Java 7 Update 40 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217040FF} /q",1,True ' Uninstall REM Java 7 Update 40 – 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86417040FF} /q",1,True ' Uninstall REM Java 7 Update 25 – 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86417025FF} /q",1,True ' Uninstall REM Java SE Development Kit 7 Update 5 WshShell.Run "msiexec /x {32A3A4F4-B792-11D6-A78A-00B0D0170050} /q",1,True ' Uninstall REM Java SE Development Kit 7 Update 45 WshShell.Run "msiexec /x {32A3A4F4-B792-11D6-A78A-00B0D0170450} /q",1,True ' Uninstall REM Adobe Flash Player 11 Plugin WshShell.Run "msiExec.exe /X{9BFB1FAB-8FC4-4FAA-9B2D-2B121834B659} /q",1,True 'regkey below stops the script from running again WshShell.RegWrite "HKLM\Software\EDU", "Default" WshShell.RegWrite "HKLM\Software\EDU\Cleanup", "Default" WshShell.RegWrite "HKLM\Software\EDU\Cleanup\JAVAOldVer", 1, "REG_SZ" End Sub
AntiVirus	Make Sure Antivirus is up to date and active scanning enabled on all machines
UTM	Check Virus/Malware scanning is enabled for HTTP/HTTPS traffic as well as email. Enable Greylisting ( builds and uses a database of ’known-good’ SMTP hosts that resend messages after receiving a temporary error) Enable BATV (Bounce Address Tag Validation) signs the reverse path of outgoing email, so it is possible to detect and drop spam and virus backscatter) Enable SPF check querying allowed sending hosts for a domain from DNS.
User Privileges	Make sure all users have the bare minimum file permissions needed to perform their job. This will help reduce what can be infected
ACLS	Set ACL's on VLANS to reduce what can be accessed by each machine. This will help reduce infection rate
Enable Click to run for Internet Explorer	Create Registry Key through GPO Preferences under User config for both staff and students HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore\AllowedDomains\RandomSite
Enable Click to run for Chrome	GPO User Configuration\Administrative Templates\Google\Google Chrome\Content Settings\setting="Click to play"
Disable Macros in MS Office	Set the below for each office application in the users GPO User Configuration->Administrative Templates->Classic Administrative Templates(ADM)->Microsoft Excel 2010->Excel Options->Security->Trust Center->VBA Macro Notification Setting
Block Malicious filetypes on Email	Block Malicious file types being sent on Email including Zip's EXE's etc
Software Restriction Policy	Disallowed by default Whitelist the below C:\Program Files (X86) C:\Program Files C:\Windows C:\Program Data Network Shares
File Screening	Enable file screening for shared and home drives, blocking any malicious file extensions
USB Security	Check SRP's and AV protect against malicious USB's
BIOS Security	Checkboot from USB is disabled, all Bios updates have been done and password protected

Edited September 22, 2015 by rrrrr

[Arthur]

Obviously you'll need the FSRM role installed on the file server to also get the Powershell commands:

 

[color="#FF0000"]Instal[/color]-WindowsFeature FS-[color="#FF0000"]Resouce[/color]-manager -includemanagementtools

^ That command doesn't look quite right.

 

Install-WindowsFeature –Name FS-Resource-Manager –IncludeManagementTools

[halbaradkenafin]

^ That command doesn't look quite right.

 

Install-WindowsFeature –Name FS-Resource-Manager –IncludeManagementTools

 

Thanks, that's what I get for not having tab completion.

[Arthur]

To add to @rrrrr's post here are a few more suggestions...

 

How to mitigate 85% of threats with only four strategies « SecureList

 

Through comprehensive, detailed analysis of local attacks and threats, the Australian Signals Directorate (ASD) has found that at least 85 per cent of the targeted cyber-intrusions it responds to could be mitigated by four basic strategies. Three of them are related to specialized security solutions. Kaspersky Lab products include technological solutions to cover these first three major strategies:

 

• Use application whitelisting to help prevent malicious software and unapproved programs from running
  
• Patch applications such as Java, PDF viewers, Flash, web browsers and Microsoft Office
  
• Patch operating system vulnerabilities
  
• Restrict administrative privileges to operating systems and applications, based on user duties.
  

 

http://vgy.me/2JLSlH.jpg

[sonofsanta]

Further to the Software Restriction Policies, once you've blocked %appdata% you need to unblock

%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu

if you want Start Menu pinned items to still work. Otherwise it blocks them completely - to the point you can open a shortcut from the Start Menu fine, then right-click>Pin, and it'll then immediately stop working.

 

EDIT:

%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

for your taskbar as well. I hadn't set that because we don't pin anything there for users (didn't want to have to explain the difference between open programs and shortcuts when we switched from XP), until I tried to open something from my taskbar and realised no-one else has them, but I have 8.

Edited September 22, 2015 by sonofsanta

[sonofsanta]

Some further updates from my testing...

 

1) The *.*enc* entry in the File Group just triggered a false positive for a user who opened a PowerPoint, and when Windows tried to create the Recent Document link, it picked up %appdata%\Microsoft\Windows\Recent\4. Ageing Population and Dependency ratio.lnk - the 4. fooled it into thinking the extension was Ageing Population and Dependency ratio.lnk, daft as that is. Computers!

 

2) The PowerShell scripts aren't firing because of the ExecutionPolicy - if I set the following arguments in the Command tab

-ExecutionPolicy Bypass -command &{C:\Disconnect-SMBShares.ps1 -username '[source Io Owner]'}

then it fires fine and works a charm

 

I'm going to leave it just firing emails for now, not triggering the script, so I can check for more false positives, but all in all it's a great system - cheers @halbaradkenafin

Edited September 22, 2015 by sonofsanta
omg the spleling

[halbaradkenafin]

We get one or two false positives a week, it's the nature of such a detection method and something that you can quickly work around with the script that's there (I've always got at least one PS Prompt open that I can quickly run the script from).