CryptoLocker Prevention

[mavhc]

Well, I just disallow all code from running unless I authorise it, problem solved.

[KK20]

I use intercept X. I also have setup cryptocanary. I fail to see the downside of the screening cryptocanary approach. I run interceptX because im paranoid about the little monsters doing things I havent thought of.

[DCUK6]

Have ESEt here and inquired about Interceptx and what they offer.

There reply was along the lines of, we dont need any addition detection as its already built into endpoint security.

 

Can i ask what freeware you use?

[Arthur]

The following is a list of Microsoft executables included with Windows that can be used to bypass AppLocker or WDAC policies.

 

https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control#create-a-windows-defender-application-control-policy-from-a-reference-computer

 

Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent application whitelisting policies, including Windows Defender Application Control:

 

addinprocess.exe
addinprocess32.exe
addinutil.exe
bash.exe
bginfo.exe [1]
cdb.exe
csi.exe
dbghost.exe
dbgsvc.exe
dnx.exe
fsi.exe
fsiAnyCpu.exe
kd.exe
ntkd.exe
lxssmanager.dll
msbuild.exe [2]
mshta.exe
ntsd.exe
rcsi.exe
system.management.automation.dll
windbg.exe
wmic.exe

[1] A vulnerability in bginfo.exe has been fixed in the latest version 4.22. If you use BGInfo, for security, make sure to download and run the latest version here. Note that BGInfo versions earlier than 4.22 are still vulnerable and should be blocked.

 

[2] If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you whitelist msbuild.exe in your code integrity policies. However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe.

[Bob_the_Goon]

Interesting. I might slowly start adding these to a prevention list, however I'm not sure if we inadvertently use any of these executables. They don't ring a bell with me. @Arthur have you added them to a blocklist yet or have you just noticed this blogpost? Has there been any issues?

[Arthur]

have you added them to a blocklist yet or have you just noticed this blogpost?

The latter. Only just come across the list.

 

I might start off by monitoring the usage of these files using Impero and then add them to AppLocker depending upon the outcome.

[Arthur]

https://twitter.com/SwiftOnSecurity/status/1009191542366535681

 

More details: Enable the Block at First Sight feature

 

[Arthur]

Windows Defender Exploit Guard in Windows 10 v1803 also has some new rules...

 

More details: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard#attack-surface-reduction-rules

 

[Arthur]

Office VBA + AMSI: Parting the veil on malicious macros

 

As part of our continued efforts to tackle entire classes of threats, Office 365 client applications now integrate with Antimalware Scan Interface (AMSI), enabling antivirus and other security solutions to scan macros and other scripts at runtime to check for malicious behaviour.

 

Macro-based threats have always been a prevalent entry point for malware, but we have observed a resurgence in recent years. Continuous improvements in platform and application security have led to the decline of software exploits, and attackers have found a viable alternative infection vector in social engineering attacks that abuse functionalities like VBA macros. Microsoft, along with the rest of the industry, observed attackers transition from exploits to using malicious macros to infect endpoints. Malicious macros have since showed up in commodity malware campaigns, targeted attacks, and in red-team activities.

 

To counter this threat, we invested in building better detection mechanisms that expose macro behaviour through runtime instrumentation within our threat protection solutions in the cloud. We’re bringing this instrumentation directly into Office 365 client applications. More importantly, we’re exposing this capability through AMSI, an open interface, making it accessible to any antivirus solution.

 

Availability

AMSI integration is now available and turned on by default on the Monthly Channel for Office 365 client applications including Word, Excel, PowerPoint, Access, Visio, and Publisher.

 

In its default configuration, macros are scanned at runtime via AMSI except in the following scenarios:

 

• Documents opened while macro security settings are set to “Enable All Macros”
  
• Documents opened from trusted locations
  
• Documents that are trusted documents
  
• Documents that contain VBA that is digitally signed by a trusted publisher
  

 

[Arthur]

Windows Defender Antivirus can now run in a sandbox

 

Windows Defender Antivirus has hit a new milestone: the built-in antivirus capabilities on Windows can now run within a sandbox. With this new development, Windows Defender Antivirus becomes the first complete antivirus solution to have this capability and continues to lead the industry in raising the bar for security.

 

Putting Windows Defender Antivirus in a restrictive process execution environment is a direct result of feedback that we received from the security industry and the research community. It was a complex undertaking: we had to carefully study the implications of such an enhancement on performance and functionality. More importantly, we had to identify high-risk areas and make sure that sandboxing did not adversely affect the level of security we have been providing.

 

 

To enable, run the following command from an elevated Command Prompt on Windows 10 v1703+, then reboot.

 

setx /M MP_FORCE_USE_SANDBOX 1

[sonofsanta]

The US-CERT email list has sent out details on the SamSam ransomware overnight. Based on the contents therein (click through to the 4 technical details pages for full info), I've added the following entries to our cryptolocker file screen group this morning:

HELP_DECRYPT_YOUR_FILES.html
*.nike2018
proteusdlll.dll
SORRY-FOR-FILES.html
ss2.stubbin
sdgasfse.dll
g04inst.bat
ClassLibrary1.dll

 

SORRY-FOR-FILES indeed. Not sorry enough.

 

(Well worth signing up for that mailing list, btw; very useful)