Block Ransomware

[pauloraponi]

Hello Guys,

Based on your experience, what would be the best policy for detect/blocking Ransomware? Can you give some examples? I'm using version 4.0

Regards,

Paulo R.

[acc6d0b3610eec313831f7900fdbd235 · Accepted solution]

Prevent malicious DLL loading by utilizing DLL Hijacking Protection EPM Background

Some of the recent attacks are using a different attack method – these attacks are loading DLLs (by either using exploits, macros or other scripts) as the delivery method for the malicious code.

Traps can block loading DLLs by certain processes from certain locations on the system, and these methods can be utilized to prevent attacks that use malicious DLL loading.

Instructions

Create 2 DLL Hijacking Protection rules:

1. Make sure the following processes are added to the ‘process management’ screen and are defined as ‘protected’.
2. Protected processes: cscript.exe, wscript.exe, mshta.exe. Load Blacklist: ’*\System\ado*;*\Windows\temp\*;*\Downloads\*;*\Temporary Internet Files\*’
3. Protected Process: rundll32.exe. Load Blacklist: ‘*\Windows\temp\*;*\Downloads\*;*\Temporary Internet Files\*;*\Appdata\Local\Temp\*’

Make sure to change to other attributes (‘No Current Dir Load’, ‘No Remote Load’, ‘No Removable Drive Load’) to off. Changes to ‘Load Exclusions List’ should be made only with help from Palo Alto Networks support.

These rules are not a part of Traps 4.0 default policy (under content update 13), since these rules are more prone to creating false events in certain environments. In case these rules are being used, and they are creating false positive events – it is highly recommended to whitelist the folder or DLL being loaded or remove the rule from the associated process

I hope it helps.

[BruceL]

NVM...found the answer:

For the XML rules configs; are these importable into the ESM in current XML format?