Detecting / mitigating Cryptolocker

Reply
Highlighted
L1 Bithead

Detecting / mitigating Cryptolocker

Hello,

my customer is worried about Cryptolocker infections in the network - CryptoLocker Ransomware Infections | US-CERT. Do you happen to have any best practices or general tips on how to use PAN tools to detect and prevent Cryptolocker from infecting hosts?

Cheers,

Tuomo

Highlighted
L7 Applicator

Re: Detecting / mitigating Cryptolocker

There are some preliminary notes at the research center saying to monitor crilock events.

And of course to make sure smtp is locked down for outbound access.

crilock.PNG.png

Steve

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
Highlighted
L4 Transporter

Re: Detecting / mitigating Cryptolocker

Thanks for posting this. How do I confirm that the PA is scanning for these viruses?

Highlighted
L1 Bithead

Re: Detecting / mitigating Cryptolocker

Thanks for the information!

Highlighted
L7 Applicator

Re: Detecting / mitigating Cryptolocker

The threat center has posted additional information in this blog.

http://researchcenter.paloaltonetworks.com/2013/11/palo-alto-networks-can-stop-cryptolocker/

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
Highlighted
L4 Transporter

Re: Detecting / mitigating Cryptolocker

Hi

I'm thinking that I have properly configured security policies against Cryptolocker.

According to above link:

     URL filtering policies in combination with File Blocking policies (block all files from unknown domains) adds an additional layer of protection, keeping the payload from being delivered.

How to realize that?

Could someone share their settings?

With regards

Slawek

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!