Ao identificar padrões semelhantes de comportamento em diferentes variantes, criamos algumas regras proativas para nossos produtos Endpoint: Endpoint Security (ENS) e Trellix Endpoint (anteriormente MVISION Endpoint). Essas regras pretendem impedir efetivamente a instalação ou a carga útil de novas variantes históricas, atuais e em evolução dessas ameaças.
Nos testes de suporte interno, descobrimos que as seguintes contramedidas ENS são eficazes contra vários tipos de ataques de ransomware:
ENS Adaptive Threat Protection Regras JTI (ATP):ative ou desative as configurações para as regras abaixo no servidor ePolicy Orchestrator (ePO) Configurações em Proteção adaptativa contra ameaças. Existem três configurações diferentes: Produtividade, Equilibrado e Segurança. As alterações feitas nas configurações do servidor se aplicam às atribuições de grupo de regras na política de opções de ATP.
Rule ID 4: Use GTI file reputation to identify trusted or malicious files
Rule ID 5: Use GTI URL reputation to identify trusted or malicious processes
Rule ID 239: Identify suspicious command parameter execution
Rule ID 240: Identify suspicious files with characteristics that have been predominantly seen in ransomware
Rule ID 255: Detect potentially obfuscated command-line parameters
Rule ID 263: Detect processes accessing suspicious URLs
Rule ID 300: Prevent office applications from starting child processes that can execute script commands
Rule ID 309: Block processes attempting to launch from Office applications.
Rule ID 312: Prevent email applications, such as Outlook, from spawning script editors and dual use tool
Rule ID 313: Prevent text editors like Notepad and WordPad from spawning processes that can execute script commands in all rule group assignments
Rule ID 316: Prevent PDF readers from starting processes that can execute scripts in all rule group assignments
Rule ID 318: Prevent PDF readers from starting cmd.exe
Rule ID 319: Prevent cmd.exe from starting other script interpreters such as cscript or PowerShell in all rule group assignments
Rule ID 323: Prevent mshta from being launched as a child process.
Rule ID 332: Prevent certutil.exe from downloading or decoding files with suspect extensions
Rule ID 341: Identify and block patterns being used in Ransomware attacks in security rule group assignments.
Rule ID 342: Identify and block patterns being used in Ransomware attacks
Rule ID 502: Detect new service creation
Rule ID 513: Detect commands used for copying files from a remote system
Rule ID 517: Prevent actor process with unknown reputations from launching processes in common system folders
ENS Dynamic Application Containment (DAC):o DAC é acionado somente se a reputação do processo atender aos critérios de reputação definidos na política de opções de ATP. Quando um processo está contido no DAC, ele está sujeito ao monitoramento pós-execução e a quaisquer regras habilitadas na política do DAC.
Rule: Deleting files commonly targeted by ransomware-class malware
Rule: Disabling critical operating system executables
Rule: Modifying appinit DLL registry entries
Rule: Modifying Image File Execution Options registry entries
Rule: Modifying screen saver settings
Rule: Modifying startup registry locations
Rule: Reading files commonly targeted by ransomware-class malware
Rule: Suspending a process
Rule: Terminating another process
Rule: Reading from another process' memory
Rule: Writing to files commonly targeted by ransomware-class malware
NOTA: Para obter as práticas recomendadas, consulte
KB87843 - Regras e práticas recomendadas de contenção dinâmica de aplicativos. Semelhante às regras de proteção de acesso, teste todas as regras DAC para evitar interrupções em seu ambiente.
ENS Threat Prevention Anti-Malware Scan Interface (AMSI):Habilite a integração com AMSI. AMSI fornece varredura de script aprimorada. A AMSI é um padrão de interface genérica que permite a integração de aplicativos e serviços com a Prevenção contra ameaças, proporcionando uma melhor proteção contra malware. A Microsoft fornece AMSI. O AMSI é compatível com os sistemas Windows 10 e Windows Server 2016 (e posteriores). Use AMSI para aprimorar a verificação de ameaças em scripts não baseados em navegador, como
PowerShell, WScripte
CScript.
Prevenção de Exploit ENS:
Signature 344: New StartUp Creation
Signature 413: Suspicious Double File Extension Execution
Signature 428: Generic Buffer Overflow
Signature 6107: MS Word trying to execute unwanted programs
Signature 6108: Suspicious download string script execution
Signature 6113: Fileless Threat: Reflective Self Injection
Signature 6114: Fileless Threat: Reflective EXE Self Injection
Signature 6115: Fileless Threat: Reflective DLL Remote Injection
Signature 6116: Mimikatz LSASS Suspicious Memory Read
Signature 6117: Mimikatz LSASS Suspicious Memory DMP Read
Signature 6120: Fileless Threat: Process Hollowing
Signature 6121: Fileless Threat: Process Hollowing
Signature 6127: Suspicious LSASS Access from PowerShell
Signature 6131: Weaponized OLE object infection via WMI
Signature 6148: Malware Behavior: Windows EFS abuse
Signature 6153: Malware Behavior: Ryuk Ransomware activity detected
Signature 6155: Malicious Behavior: Directory Junction attempt detected
Regras de especialista em prevenção de exploração do ENS:O repositório Trellix Advanced Research Center
GitHub contém um conjunto de amostras de regras de especialista que podem ser usadas diretamente com o ENS na política de prevenção de exploração. As regras do especialista abaixo são específicas para direcionar ataques de ransomware:
Detect_Deletion_Of_Shadow_Copies_Using_WMIC.EXE.md.txt
Detect_Suspicious_Usage_Of_VSSADMIN.EXE.md.txt
File_Block_Rclone (Dois cenários fornecidos para esta regra.)
Regras padrão de proteção de acesso do ENS:
Browsers launching programs from downloaded programs file folders
Creating new executable file in the programs files folder
Creating new executable file in the windows folder
Disabling registry editor and task manager
Doppelganger attack on processes
Executing mimikatz malware
Executing scripts by windows script host
Remotely creating or modifying files or folders
Remotely creating or modifying PE,.INI and core system locations
