Your best defense against ransomware: Find the early warning signs

As ransomware continues to prove how devastating it can be, one of the scariest things for security pros is how quickly it can paralyze an organization. Just look at Honda, which was forced to shut down all global operations in June, and Garmin, which had its services knocked offline for days in July.

Ransomware isn’t hard to detect but identifying it when the encryption and exfiltration are rampant is too little too late. However, there are several warning signs that organizations can catch before the real damage is done. In fact, FireEye found that there is usually three days of dwell time between these early warning signs and detonation of ransomware.

So, how does a security team find these weak but important early warning signals? Somewhat surprisingly perhaps, the network provides a unique vantage point to spot the pre-encryption activity of ransomware actors such as those behind Maze.

Here’s a guide, broken down by MITRE category, of the many different warning signs organizations being attacked by Maze ransomware can see and act upon before it’s too late.

Initial access

With Maze actors, there are several initial access vectors, such as phishing attachments and links, external-facing remote access such as Microsoft’s Remote Desktop Protocol (RDP), and access via valid accounts. All of these can be discovered while network threat hunting across traffic. Furthermore, given this represents the actor’s earliest foray into the environment, detecting this initial access is the organization’s best bet to significantly mitigate impact.

ATT&CK techniques	Hunt for…
T1193 Spear-phishing attachment T1192 Spear-phishing link	Previously unseen or newly registered domains, unique registrars Doppelgangers of your organization / partner’s domains or Alexa top 500
T133 External Remote Services	Inbound RDP from external devices
T1078 Valid accounts	Exposed passwords across SMB, FTP, HTTP, and other clear text usage
T1190 Exploit public-facing application	Exposure and exploit to known vulnerabilities

 

Execution

The execution phase is still early enough in an attack to shut it down and foil any attempts to detonate ransomware. Common early warning signs to watch for in execution include users being tricked into clicking a phishing link or attachment, or when certain tools such as PsExec have been used in the environment.

ATT&CK techniques	Hunt for…
T1024 User execution	Suspicious email behaviors from users and associated downloads
T1035 Service execution	File IO over SMB using PsExec, extracting contents on one system and then later on another system
T1028 Windows remote management	Remote management connections excluding known good devices

 

Persistence

Adversaries using Maze rely on several common techniques, such as a web shell on internet-facing systems and the use of valid accounts obtained within the environment. Once the adversary has secured a foothold, it starts to become increasingly difficult to mitigate impact.

ATT&CK techniques	Hunt for…
T1100 Web shell	Unique activity connections (e.g. atypical ports and user agents) from external connections
T1078 Valid accounts	Remote copy of KeePass file stores across SMB or HTTP

 

Privilege escalation

As an adversary gains higher levels of access it becomes significantly more difficult to pick up additional signs of activity in the environment. For the actors of Maze, the techniques used for persistence are similar to those for privileged activity.

ATT&CK techniques	Hunt for…
T1100 Web shell	Web shells on external facing web and gateway systems
T1078 Valid accounts	Remote copy of password files across SMB (e.g. files with “passw”)

 

Defense evasion

To hide files and their access to different systems, adversaries like the ones who use Maze will rename files, encode, archive, and use other mechanisms to hide their tracks. Attempts to hide their traces are in themselves indicators to hunt for.

ATT&CK techniques	Hunt for…
T1027 Obfuscated files or information	Adversary tools by port usage, certificate issuer name, or unknown protocol communications
T1078 Valid accounts	New account creation from workstations and other non-admin used devices

 

Credential access

There are several defensive controls that can be put in place to help limit or restrict access to credentials. Threat hunters can enable this process by providing situational awareness of network hygiene including specific attack tool usage, credential misuse attempts and weak or insecure passwords.

ATT&CK techniques	Hunt for…
T110 Brute force	RDP brute force attempts against known username accounts
T1081 Credentials in files	Unencrypted passwords and password files in the environment

 

Discovery

Maze adversaries use a number of different methods for internal reconnaissance and discovery. For example, enumeration and data collection tools and methods leave their own trail of evidence that can be identified before the exfiltration and encryption occurs.

ATT&CK techniques	Hunt for…
T1201 Password policy discovery	Traffic of devices copying the password policy off file shares Enumeration of password policy
T1018 Remote system discovery T1087 Account discovery T1016 System network configuration discovery T1135 Network share discovery T1083 File and directory discovery	Enumeration for computer names, accounts, network connections, network configurations, or files

 

Lateral movement

Ransomware actors use lateral movement to understand the environment, spread through the network and then to collect and prepare data for encryption / exfiltration.

ATT&CK techniques	Hunt for…
T1105 Remote file copy T1077 Windows admin shares	Suspicious SMB file write activity PsExec usage to copy attack tools or access other systems Attack tools copied across SMB
T1076 Remote Desktop Protocol T1028 Windows remote management T1097 Pass the ticket	HTTP POST with the use of WinRM user agent Enumeration of remote management capabilities Non-admin devices with RDP activity

 

Collection

In this phase, Maze actors use tools and batch scripts to collect information and prepare for exfiltration. It is typical to find .bat files or archives using the .7z or .exe extension at this stage.

ATT&CK techniques	Hunt for…
T1039 Data from network share drive	Suspicious or uncommon remote system data collection activity

 

Command and control (C2)

Many adversaries will use common ports or remote access tools to try and obtain and maintain C2, and Maze actors are no different. In the research my team has done, we’ve also seen the use of ICMP tunnels to connect to the attacker infrastructure.

ATT&CK techniques	Hunt for…
T1043 Common used port T1071 Standard application layer protocol	ICMP callouts to IP addresses Non-browser originating HTTP traffic Unique device HTTP script like requests
T1105 Remote file copy	Downloads of remote access tools through string searches
T1219 Remote access tools	Cobalt strike BEACON and FTP to directories with cobalt in the name

 

Exfiltration

At this stage, the risk of exposure of sensitive data in the public realm is dire and it means an organization has missed many of the earlier warning signs—now it’s about minimizing impact.

ATT&CK techniques	Hunt for…
T1030 Data transfer size limits	External device traffic to uncommon destinations
T1048 Exfiltration over alternative protocol
T1002: Data compressed

 

Summary

Ransomware is never good news when it shows up at the doorstep. However, with disciplined network threat hunting and monitoring, it is possible to identify an attack early in the lifecycle. Many of the early warning signs are visible on the network and threat hunters would be well served to identify these and thus help mitigate impact.

from Help Net Security https://ift.tt/3crX3D9

Related Items