Staff running\saving .exe - Do you allow it?

[maxrebo]

Trying to nail down certain areas of the network to prevent Crypto locker, what do people do with regards to staff saving .exe \ zip files?

Do you allow them at all (in any area) (Home folder \ staff drive) or block them entirely?

 

Trying to find and happy medium for everyone.

[Sagima]

No exe in home drives. we allow zip though.

If you're looking to stop ransomware though this page gives instructions on using fsrm - it's what we do

 

https://fsrm.experiant.ca/

[Rob_D]

We block .exe files from being saved/run anywhere staff have access to (with specific exceptions for the techy areas that staff shouldn't be able to get to). Why would a teacher ever need to run a random .exe anyway?

 

Can't do the same for .zip as too much legit stuff comes in that way.

 

The other thing we're implementing to stop cryptolocker files, are policies that stop encrypted files from being saved to the shared areas. And one of our contractors is doing something fancy with a database of common cryptolocker extensions or something (not quite sure what they're planning).

[dry]

.exe cannot be run/saved to network areas by anybody other than IT admins.

Like many others on here, we use FSRM to prevent known-cryptolocker encrypted files from being saved to the network.

At the moment, variants are added manually as and when I hear of new variants- but I will look into automating this process. There's an interesting PowerShell script on the website @Sagima linked to:

 

new-FsrmFileGroup -name "Anti-Ransomware File Groups" -IncludePattern @((Invoke-WebRequest -Uri "https://fsrm.experiant.ca/api/v1/get" -UseBasicParsing).content | convertfrom-json | % {$_.filters})

 

How often that database is updated is another question though!

 

Email notifications of FSRM hits so far include things like 'CouponDownloader.exe' and 'SpotifySetupFull.exe' etc.

[Katy]

We have FSRM file screen to email us if it sees anything that was in the "common cryptolocker extensions" list (probably massively out of date by now since I set it up months ago). Anybody can save an EXE to their home drives but only IT admin group can execute EXEs (by software restriction policy). Staff/students can only run EXEs which are allowed by file hash in the policy or located in specific folders that they don't have write access to (c:\program files, the programs share etc).

 

Only problems with this is when they tell you at 3:55pm that they need to be on a 4pm webinar and it is ALWAYS stupid WebEx or Go To Meeting that tries to get them to download and run an exe with all the connection baked inside it, so you can't even allow the file hash. To get round this we temporarily de-restricted a randomly named folder and saved it/ran it from there.

 

zip files aren't restricted at all but if they have anything nasty inside they would fail to execute when extracted.

 

Another thing we do is set the default program for .js files (and a few others) to notepad to stop them from running if teachers are tricked into double-clicking on a nasty javascript or VBscript file.

[Arthur]

Only problems with this is when they tell you at 3:55pm that they need to be on a 4pm webinar and it is ALWAYS stupid WebEx or Go To Meeting that tries to get them to download and run an exe with all the connection baked inside it, so you can't even allow the file hash. To get round this we temporarily de-restricted a randomly named folder and saved it/ran it from there.

This is where AppLocker is better than SRP since you can deny all executables from running in AppData (%OSDRIVE%\Users\*\AppData\*) and then setup "Publisher" exceptions (in the same rule) that allow those stupid webinar/meeting EXEs based on their digital signature.

 

I have exceptions setup for WebEx, GoToWhatever, Teamviewer and LogMeIn, but only for certain staff in a specific AD group.

 

It's about time Cisco and Citrix update their software so that it works entirely in the browser (like Google Hangouts). End users shouldn't be downloading random executables from the Internet!

[Arthur]

Do you allow them at all (in any area) (Home folder \ staff drive) or block them entirely?

We block EXEs from all user and shared areas.

 

Even if ransomware wasn't a concern, teachers running unlicensed software would be.

 

The other thing we're implementing to stop cryptolocker files, are policies that stop encrypted files from being saved to the shared areas. And one of our contractors is doing something fancy with a database of common cryptolocker extensions or something (not quite sure what they're planning).

How do you deal with ransomware that doesn't use a unique extension for encryption?

[Sheridan]

We block .exe unless in an 'approved' folder (i.e we can put things in there!) but allow zip files etc.

 

This is done with SRP or Applocker (W10) and SRP has been the most reliable for us by far. FSRM stops anything being saved in places where it should and its never been an issue

[Rob_D]

How do you deal with ransomware that doesn't use a unique extension for encryption?

Largly the "no running/saving .exe" rule, and user training in the vein of "If your computer does something hinky pull all the cables out the back." along with on access AV scanning.

 

There was talk of being able to stop any encrypted files from being saved back to the server, but I'm not if it's something we actually got working.

[maxrebo]

thanks everyone a lot of info there to work through

[MYK-IT]

.exe cannot be run/saved to network areas by anybody other than IT admins.

Like many others on here, we use FSRM to prevent known-cryptolocker encrypted files from being saved to the network.

At the moment, variants are added manually as and when I hear of new variants- but I will look into automating this process. There's an interesting PowerShell script on the website @Sagima linked to:

 

new-FsrmFileGroup -name "Anti-Ransomware File Groups" -IncludePattern @((Invoke-WebRequest -Uri "https://fsrm.experiant.ca/api/v1/get" -UseBasicParsing).content | convertfrom-json | % {$_.filters})

 

How often that database is updated is another question though!

 

Email notifications of FSRM hits so far include things like 'CouponDownloader.exe' and 'SpotifySetupFull.exe' etc.

 

Out of interest, is there an equivalent for Windows 2008 servers? As this command does not work, and have to us the Filescrn command instead.

 

Just trying to see how I can add the 100's of filenames/wildcards into the /Member switch section of that command.

 

Thanks,

 

Just to update (as may be useful for others)

I've managed to do it by using the filescrn filegroup export /File: /Filegroup command on a WS2012 that had the 'Anti-Ransomware File Groups" setup (as per @dry method), copied .xml file over then used the import switches for filescrn filegroup import /File: command on the WS2008.

Edited February 1, 2017 by MYK-IT
UPDATE

[kennysarmy]

No exe in home drives. we allow zip though.

If you're looking to stop ransomware though this page gives instructions on using fsrm - it's what we do

 

https://fsrm.experiant.ca/

 

This looks very good....

[StephenKing]

This looks very good....

 

See here also.

 

Pretty good list of some things to consider (see prevention tab). Some obviously more effective than others, but also some that might have more a negative impact on the day-to-day workings of the business.

Edited February 2, 2017 by StephenKing

[RJohnson91]

We don't give any staff local admin rights to install anything.

 

Most of my users can't drag and drop let along install software... That being said, we don't block the opening of ZIP files ... maybe one to think about.

 

Ryan

[kennysarmy]

No exe in home drives. we allow zip though.

If you're looking to stop ransomware though this page gives instructions on using fsrm - it's what we do

 

https://fsrm.experiant.ca/

 

When running the command they specify on their site:

 

new-FsrmFileGroup -name "Anti-Ransomware File Groups" -IncludePattern @((Invoke-WebRequest -Uri "https://fsrm.experiant.ca/api/v1/combined" -UseBasicParsing).content | convertfrom-json | % {$_.filters})

 

I get an error

 

 

Anyone any ideas?

[kennysarmy]

When running the command they specify on their site:

 

new-FsrmFileGroup -name "Anti-Ransomware File Groups" -IncludePattern @((Invoke-WebRequest -Uri "https://fsrm.experiant.ca/api/v1/combined" -UseBasicParsing).content | convertfrom-json | % {$_.filters})

 

I get an error

 

[ATTACH=CONFIG]41271[/ATTACH]

 

Anyone any ideas?

 

Doh;

 

I should have run : the command for updating existing Server 2012 / 2012 R2 FSRM installations and not for new Server 2012 / 2012 R2 FSRM installations:

 

set-FsrmFileGroup -name "Anti-Ransomware File Groups" -IncludePattern @((Invoke-WebRequest -Uri "https://fsrm.experiant.ca/api/v1/combined" -UseBasicParsing).content | convertfrom-json | % {$_.filters})

[fiza]

Resurrecting this one as most here block executable files. Do your students use Visual Studio? How do you save project files when there are a number of exe files in there? Our Computing Teacher needs to use Visual Studio with the students but we only allow it in Virtualbox with a mapped home drive. The home drive is set up with fsrm to block the saving of exe files. I am unsure as to how to proceed with this as I don't want to restrict the teacher from using Visual Studio with the students.

[Katy]

Resurrecting this one as most here block executable files. Do your students use Visual Studio? How do you save project files when there are a number of exe files in there? Our Computing Teacher needs to use Visual Studio with the students but we only allow it in Virtualbox with a mapped home drive. The home drive is set up with fsrm to block the saving of exe files. I am unsure as to how to proceed with this as I don't want to restrict the teacher from using Visual Studio with the students.

We allow EXEs in the Documents\Visual Studio 2013 folder, the main purpose of our EXE block is to stop accidental execution of nasties e.g. of EXEs disguised as PDFs and the like.

[fiza]

We allow EXEs in the Documents\Visual Studio 2013 folder, the main purpose of our EXE block is to stop accidental execution of nasties e.g. of EXEs disguised as PDFs and the like.

Do you FSRM for this? Can you put an exception on a sub folder of their home drive?

[Katy]

Do you FSRM for this? Can you put an exception on a sub folder of their home drive?

No, we use software restriction policies.

[jthompson]

Resurrecting this one as most here block executable files. Do your students use Visual Studio? How do you save project files when there are a number of exe files in there? Our Computing Teacher needs to use Visual Studio with the students but we only allow it in Virtualbox with a mapped home drive. The home drive is set up with fsrm to block the saving of exe files. I am unsure as to how to proceed with this as I don't want to restrict the teacher from using Visual Studio with the students.

You could lift the EXE restriction in FSRM, but still have in place SRP or AppLocker to prevent users executing any of them directly from your domain machines.

 

Your VirtualBox VM is presumably sandboxed with no networking, so would be able to run them in relative safety. They could potentially trash all of their own files by doing something daft in the VM, but that's about the extent of it.

[AlanD]

No. No executables...unless they are allowed by gpo or are in the program files folder that they don’t have write access to.

[fiza]

No. No executables...unless they are allowed by gpo or are in the program files folder that they don’t have write access to.

Do the Computing Teachers in your School not use Visual Studio?

[fiza]

You could lift the EXE restriction in FSRM, but still have in place SRP or AppLocker to prevent users executing any of them directly from your domain machines.

 

Your VirtualBox VM is presumably sandboxed with no networking, so would be able to run them in relative safety. They could potentially trash all of their own files by doing something daft in the VM, but that's about the extent of it.

Could you still use FSRM to prevent saving of exe files. Have an exception for the visual studio folder and then use SRP as a path rule on the visual studio folder to stop them running the exe there but are still able to save there? They can then run the exe in the Virtualbox ?

[jthompson]

I think you'd want your SRP blocking the whole of the user area. The VirtualBox VM wouldn't be subject to that SRP though, so would be free to execute EXE (or indeed anything). I'm assuming the VM has no networking and that the user area folder is available as a shared folder (can't remember the VirtualBox terminology, but basically it's not using the network at all but rather is having those files made available to it locally by the host OS).