On 7 June 2016 at 13:29, Eero Volotinen <[email protected]> wrote:
> Well. This is impossible. There is no way to see difference between normal > file access and virus crypting all your files.. There are some common extensions for very common ransomware/crypto stuff that you can look for but be prepared for false positives, to add to the extensions list and for the list to change with new iterations of the malware. For example: https://www.reddit.com/r/sysadmin/comments/46361k/list_of_ransomware_extensions_and_known_ransom/ You can also do things like script checking the entropy level of files in a directory and generate alerts based on that output. Now, though, we're talking about doing stuff well outside of OSSEC and just having OSSEC send alerts if <canary> is or isn't present. One quick-and-easy thing to do is to have a canary directory or file that nobody should ever access. If you see the access time change on the directory, write a file that triggers an alert. If a new file shows in the directory, trigger an alert. If anything in the directory changes, trigger an alert. As you said, the hard part of identifying virus behaviour is that it mimics things we do every day. kmw -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
