Couldn't pass be used to monitor the frequency of files accessed or rewritten on a share via the logs generated from those operations? It might not be foolproof, but if the log shows a single account accessing several files faster than a human might be able to, it could alert, or even block. Maybe I'm missing something. On Jun 7, 2016 13:58, "Kevin Wilcox" <[email protected]> wrote:
> On 7 June 2016 at 13:29, Eero Volotinen <[email protected]> wrote: > > > Well. This is impossible. There is no way to see difference between > normal > > file access and virus crypting all your files.. > > There are some common extensions for very common ransomware/crypto > stuff that you can look for but be prepared for false positives, to > add to the extensions list and for the list to change with new > iterations of the malware. > > For example: > > > https://www.reddit.com/r/sysadmin/comments/46361k/list_of_ransomware_extensions_and_known_ransom/ > > You can also do things like script checking the entropy level of files > in a directory and generate alerts based on that output. Now, though, > we're talking about doing stuff well outside of OSSEC and just having > OSSEC send alerts if <canary> is or isn't present. > > One quick-and-easy thing to do is to have a canary directory or file > that nobody should ever access. If you see the access time change on > the directory, write a file that triggers an alert. If a new file > shows in the directory, trigger an alert. If anything in the directory > changes, trigger an alert. > > As you said, the hard part of identifying virus behaviour is that it > mimics things we do every day. > > kmw > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
