topic Re: Detecting / mitigating Cryptolocker in General Topics

Detecting / mitigating Cryptolocker

Tuomo — Fri, 15 Nov 2013 14:13:12 GMT

Hello,

my customer is worried about Cryptolocker infections in the network - CryptoLocker Ransomware Infections | US-CERT. Do you happen to have any best practices or general tips on how to use PAN tools to detect and prevent Cryptolocker from infecting hosts?

Cheers,

Tuomo

Re: Detecting / mitigating Cryptolocker

pulukas — Fri, 15 Nov 2013 14:36:29 GMT

There are some preliminary notes at the research center saying to monitor crilock events.

And of course to make sure smtp is locked down for outbound access.

Steve

Re: Detecting / mitigating Cryptolocker

mario11584 — Mon, 18 Nov 2013 19:33:21 GMT

Thanks for posting this. How do I confirm that the PA is scanning for these viruses?

Re: Detecting / mitigating Cryptolocker

Tuomo — Thu, 05 Dec 2013 12:57:01 GMT

Thanks for the information!

Re: Detecting / mitigating Cryptolocker

pulukas — Thu, 05 Dec 2013 15:55:31 GMT

The threat center has posted additional information in this blog.

http://researchcenter.paloaltonetworks.com/2013/11/palo-alto-networks-can-stop-cryptolocker/

Re: Detecting / mitigating Cryptolocker

_slv_ — Fri, 06 Dec 2013 12:43:22 GMT

I'm thinking that I have properly configured security policies against Cryptolocker.

According to above link:

URL filtering policies in combination with File Blocking policies (block all files from unknown domains) adds an additional layer of protection, keeping the payload from being delivered.

How to realize that?

Could someone share their settings?

With regards

Slawek