Crypto Prevention

4 minute read

Description:

In light of all the crypto viruses going around, I found this great guide on Reddit for crypto prevention techniques:

To Resolve:

  1. 2019-06-13 Updated notes ``` Offline backups. 3-2-1 Backup Rule. Test it.

Enable AppLocker. Allow signed execution only. Disallow %Temp% or %AppData% entirely.

Require local administrators enter credentials for UAC (and minimize the number of local admins).

Network segregation: Workstations should not be able to SMB to one another cross-departmentally, or cross-floors/cross-rooms/whatever segregation/etc. This can isolate an infection to a single department/floor/room/space only. And should use centralized servers for inter-file transfers (or email/OneDrive/chat services). Local Admins should not have access to C$ on the servers.

Don’t allow email to contain: Executables, password protected zip files, or Office macros.

Another one i’d like to add: Use LAPS to randomize your local admin passwords! most of these cryplockers are not that smart and use stuff like psexec to spread itself and if you have the same local admin password on all your machines you are pretty much frakked.

Also, get something that monitors your network and file servers for suspicious activity like mass encryption of files. And/or get a virus scanner that doesnt just look at files but also behaviour like for example CB defense.

Also remove the ability to execute js, vbs, wse, vbe, jse, vbe and ps1, also tonnes of group policy templates online to block if applocker not available and you fallback to SRP.

``` Source

  1. Install File Server Resource Manager

a. 2008(R2): Server Manager – Roles – Add Roles – Add Roles Wizard – Server Roles- File Services – Role Services – File Server Resource Manager

b. 2012(R2): Server Manager – Manage – Add Roles and Features – Add Roles and Features Wizard – Server Roles- File and Storage Services – File and iSCSI Services – File Server Resource Manager

  1. Server-side protection from further encryption

a. Open File Server Resource Manager (Start – Run – fsrm.msc)

b. File Screening Management – File Groups – Create File Group… – File group name: 1-PreventCrypto

c. Files to include:

.aaa
*.cryptotorlocker*
*.ecc
*.encrypted
*.exx
*.ezz
*.frtrss
*.vault
*.vvv
*restore_fi*.

*want your files back.*
confirmation.key
cryptolocker.*
decrypt_instruct*.*
enc_files.txt
help_decrypt*.*
help_restore*.*
help_your_file*.*
how to decrypt*.*
how_recover*.*
how_to_decrypt*.*
how_to_recover*.*
howtodecrypt*.*
install_tor*.*
last_chance.txt
message.txt
readme_for_decrypt*.*
recovery_file.txt
recovery_key.txt
vault.hta
vault.key
vault.txt
your_files.url
*gmail*.crypt
howto_restore_file*.*
*.crjoker

d. After creating the file group per above, update the entire list easily by running C:Windows1-PreventCrypto-FileGroupUpdate.bat. You must edit this .bat to include the name of your file group

Batch file source:
@ECHO OFF
REM This file was last updated 01/13/2016

REM Edit to match your filegroup below…
filescrn.exe filegroup modify /filegroup:”1-PreventCrypto” /members:”*.aaa|*.cryptotorlocker*|*.ecc|*.encrypted|*.exx|*.ezz|*.frtrss|*.vault|*.vvv|*restore_fi*.*|*want your files back.*|confirmation.key|cryptolocker.*|decrypt_instruct*.*|enc_files.txt|help_decrypt*.*|help_restore*.*|help_your_file*.*|how to decrypt*.*|how_recover*.*|how_to_decrypt*.*|how_to_recover*.*|howtodecrypt*.*|install_tor*.*|last_chance.txt|message.txt|readme_for_decrypt*.*|recovery_file.txt|recovery_key.txt|vault.hta|vault.key|vault.txt|your_files.url|*gmail*.crypt|howto_restore_file*.*|*.crjoker”
ECHO.

PAUSE
EXIT

REM More info at https://technet.microsoft.com/en-us/library/cc788114(v=ws.10).aspx

e. File Screening Management – File Screen Templates – Create File Screen Template…

-Settings tab
Template name: 1-PreventCrypto
Screening type: Passive screening
File groups: Check “1-PreventCrypto”

-E-mail Message tab
Subject: Unauthorized file from the [Violated File Group] file group detected
Body:
User [Source Io Owner]
Saved [Source File Path] to [File Screen Path]
On server: [Server]
This file is in the [Violated File Group] file group in FSRM, which generated this alert.
A batch was run to remove all server shares until corrective action is taken.

-Event Log tab
Check “Send warning to event log”

-Command tab
Check “Run this command or script”
Browse… C:Windows1-PreventCrypto.bat
NOTE: you must edit this .bat to include the names of all your shares
Select radio button: “Local System”

f. File Screening Management – File Screens – Create File Screen…

-File screen path: C: (or just the drive/folder containing shares)
Select radio button: “Derive properties from this file screen template (recommended)”
Select from dropdown: “1-PreventCrypto”

g. File Server Resource Manager (Local) – right-click: Configure options…

-Email Notifications tab
Set SMTP server name (use SMTP relay if you don’t have a mail server on-site)
Set Default administrator (see how to)

-Notification Limits tab
Set all to 2 minutes

  1. Other protections worth doing

a. Ensure Internet filter is updating to block known badware domains (suggestion: DNS Redirector)

b. Ensure Internet filter is blocking ccTLDs and IDNs that are not relevant to your business (suggestion: DNS Redirector, see how to)

c. Ensure Firewall is blocking any URLs with an IP address (only the bad guys do this)
Bad: http://93.184.216.34 | Good: http://example.com | see how to

d. Ensure Firewall is blocking DNS outbound from everything except your internal/AD DNS server IP(s)

e. Ensure Firewall is allowing only good/necessary ports outbound (NOT any/any)
Suggestion for DCs: 53,80,123,443,3544 | Suggestion for End-Users: 80,443,1935,3544

f. Run CryptoPrevent by Foolish IT on every end-user workstation, apply at least the standard rules, restart

g. Consider implementing Software Restriction Policies (SRP) via Group Policy (or AppLocker, or application whitelist)

h. Use an anti-virus product and/or Malwarebytes on end-user workstations, ensure it is updating

  1. Cleanup procedure

a. Either you received an email from FSRM with the details, or you suddenly realized all server shares are missing…

-On the server which detected the bad files go to Event Viewer > Windows Logs > Application
Look for a Warning entry from SRMSVC as the source, the General box contains the details of the username and filename which triggered the shares to be removed

b. Unplug the offending user’s machine from the network

c. Cleanup user’s temp folders and startup items (suggestion: CCleaner)

d. Ensure user’s machine is malware/toolbar/nonsense free (suggestion: Malwarebytes)

e. Run CryptoPrevent by Foolish IT apply at least the standard rules, restart

f. Format and reload the OS on this user’s machine if you prefer

g. Restore any files that did get encrypted from your backups. NOTE: Many variants of this badware do NOT change the file modified time/date stamp to when encryption occurred

h. Add all the shares back to the server (see created file: C:Windows1-PreventCrypto-PreviousShares.txt)

i. Re-enable the Windows firewall rules for File and Printer Sharing


References:

https://www.reddit.com/r/sysadmin/comments/3gm9ji/cryptolockercryptowall_prevention_file_screening/
http://jpelectron.com/sample/Info%20and%20Documents/Stop%20crypto%20badware%20before%20it%20ruins%20your%20day/1-PreventCrypto-Readme.htm