MITRE ATT&CK Enriches Ransomware Detection

The Network: A United Kingdom-based Managed Service Provider (MSP) specializing in managed IT, cloud, telecom, and security monitoring services uses Netsurion to provide SOC-as-a-Service (SOCaaS) capabilities to their end clients, and to rapidly detect security incidents within the MSP’s own environment.

The Expectation: Netsurion’s SIEM services, advanced endpoint protection, and behavior analytics deliver added protection for the IT service provider and their clients.

The Catch: Detections of WannaCry ransomware. Netsurion Open XDR detected Indicators of Compromise (IOCs) that signify a WannaCry infection on the newly integrated host computer. WannaCry ransomware can also be known as CrySis, WanaCry, Wcry, and Wanna Decryptor. Common infection methods of WannaCry ransomware include:

• Social engineering via phishing emails
• Malvertising on legitimate websites loaded with infected ads
• Exploit kits used by adversaries for targeted campaigns on known website and application vulnerabilities

The Find: Netsurion’s Security Operations Center (SOC) detected many unknown MD5 hashes that had not been seen previously and where the hash reputation was poor. The security analyst in the SOC correlated the IOC and attack patterns to that of WannaCry. WannaCry is a ransomware crypto worm that targets computers running the Microsoft Windows operating system. It encrypts data and demands ransom payments in Bitcoin crypto currency to unlock the files. WannaCry is also referred to as network worm because it includes a “transport” mechanism to rapidly spread itself by scanning vulnerable Microsoft systems. First seen in a global outbreak in 2017, WannaCry continues to lurk in infected computers and disrupt companies of all sizes and industries with its threats.

On seeing so many hashes with bad reputations, Netsurion’s SOC analyst followed the standard operation procedure to proactively call and email the MSP within 15 minutes of detection. Netsurion’s security analyst was quick and responsive in detecting the ransomware and providing enriched threat intelligence from MITRE ATT&CK regarding the threat and known adversary techniques.

Actual Microsoft Windows processes leveraged in carrying out the attack:

• attrib +h
  • Attempt to hide the Wannacry executable file.
• icacls . /grant Everyone:F /T /C /Q
  • Granting all user to the folder and sub-folders.
• wmic shadow copy delete
  • WMIC.exe can be used to delete all volume shadow copies (data backup) on a system.
• Net  Stop “EventTracker Monitoring Daemon” and C:\Windows\system32\net1  Stop “EventTracker Monitoring Daemon”
  • Attempts to stop the Netsurion Monitoring Daemon service on the host, essentially to inhibit the remedial actions for the detected incidents.

WannaCry Adversary Tactics and Techniques in MITRE ATT&CK:

The Fix: Netsurion’s SOC promptly alerted the MSP about the detections. All identified malicious hashes and IP addresses were immediately moved to an unsafe list for process termination on the infected system. The identified WannaCry hashes were then added to Netsurion Threat Center, our threat intelligence repository to assist in rapid detection across all Netsurion customers.

Recommendations to mitigate this WannaCry ransomware include:

• Adhere to a strict password policy and least privilege policy.
• Educate users on social engineering and anti-phishing email awareness programs.
• Implement enhanced email security with email protocols such as Domain-based Message Authentication, Reporting, & Conformance (DMARC), Sender Policy Framework (SPF), and DomainKeys Identification Mail (DKIM) policies.
• Update anti-virus and anti-malware software with current signatures.
• Closely monitor network share and block the unnecessary shares.
• Implement frequent backups of all-important files and isolate them from local and open networks. Also keep offline backups of data stored in locations inaccessible from infected computer.
• Maintain patches from software and application vendors such as Microsoft in the case of WannaCry.
• Identify which systems and applications are mission critical to your business and day-to-day operations.
• Implement and practice a digital Incident Response (IR) plan.

The Lesson: Adversaries are actively targeting the trusted relationships of MSPs. Netsurion’s integrated SIEM and Endpoint Detection and Response (EDR) capability was instrumental in detecting and disrupting this ransomware activity. Continuous monitoring from Netsurion ensures 24/7/365 visibility and rapid mitigation. Learn more about how Netsurion protects organizations against advanced cybersecurity threats.

Detected Indicators of Compromise (IoCs):