topic Re: How do I test ransamware myself ? in General Topics

How do I test ransamware myself ?

awawa100 — Mon, 09 Sep 2019 09:00:15 GMT

Hello, everyone of the specialist

I plan to settings for wannacry in the Pan-OS 8.1
I want to check in advance that the settings will work

But I can't have a real wannacry on my PC
So I'm worried about how to prepare a fake wannacry

Do you have a good idea

Thank you

～～～～japanese

こんにちは、スペシャリストの皆さん

私はPan-OS 8.1でwannacryに対する設定をする予定です

その設定が間違いなく動作するかを事前に確認したいです

ですが、私が本物のwannacryをPCに用意するわけにはいかないです

そこで、偽のwannacryをどうやって用意するかを悩んでいます

良いアイデアはありますか

ありがとう

Re: How do I test ransamware myself ?

BPry — Mon, 09 Sep 2019 14:55:15 GMT

@awawa100,

The firewall itself can only prevent you from downloading the file in the first place, so testing this won't actually require you to run anything. Ransomware samples are prevelant; try to download some and if it actually downloads successfully.

The firewall should really only be one of the layers involved in your defence, and I wouldn't rely on it actually stopping users from downloading ransomware. If you are fully decrypting the traffic it should be able to catch files already identified by WildFire, but that only goes so far. I would recommend that you ensure you have something like Traps or CrowdStrike installed on your endpoints, as they both actually serve to stop the ransomware from actually locking down the system or spreading within your network.

When it comes to actual testing you don't do malware testing on just any machine. You want to make it so that the machine you are using for testing is actually isolated from anything else on your network if it needs any network connectivity at all; and I would generally recommend utilizing a sandboxed VM on an isolated host.

Re: How do I test ransamware myself ?

OtakarKlier — Wed, 11 Sep 2019 16:45:48 GMT

Hello,

Please listen to what BPry is saying. Always use a test machine and make sure its segregated from the rest of the network. If you subscribe to wildfire, you can test it as they have a test file to use.

https://wildfire.paloaltonetworks.com/wildfire/account

Regards,

Re: How do I test ransamware myself ?

awawa100 — Tue, 24 Sep 2019 09:23:05 GMT

Experts
Thanks for some advice

We chose metasploit as a penetration tool

I was able to see the threat alert

Thank you everyone

日本語～～～～～

エキスパートの皆さん
いくつかのアドバイスをありがとう

ぺネストレーションのツールとして、metasploitを選びました

脅威のアラートを確認することができました

みなさん、ありがとうございました