ENS unable to detect threats running on the Ransomware Simulator

[dilan90]

Hi,

Need help on creating strong ENS Threat Prevention & ATP policy against simulated threats from KnowBe4 ransomware simulator. The attached result is the output we got from Simulator tool against the existing ENS policies. 

Note: ENS ATP Rule group at Balance mode

Trellix Endpoint Security 

[Daveb3d]

If you have TIE, your best bet for this is to use DAC in ATP and contain at Unknown.  Set the memory injection rules to block and the deleting/modifying files associated with ransomware to block.  This should generally protect you.  

[Daveb3d]

Actually, I just tried it myself.  How did you even get it working?  Two of the files were getting killed at execution for me, so it won't even run by default. 

Dave

[Daveb3d · Accepted solution]

So not trying to spam, but turning off OAS and changing some reputations in TIE, I was able to get it to run.  Using DAC as I defined above, I was able to get 0/19 vulnerable.  19/19  not vulnerable and 2 incorrectly blocked.  I suspect the latter two are just because I need to trust something that isn't trusted in TIE, which isn't hard, but didn't spend the time to figure it out.

Dave

[dilan90]

Hi @Daveb3d,

For me also got  two events blocked by ENS, Could I have the policy exported please to test it out.

[dilan90]

Hi @Daveb3d,

Appreciate your cooperation on this. I also able to get 0/19 vulnerable by changing the DAC rule. Can you please explain more about Memory Injection rule thing further

Thanks

Dilan

[Daveb3d]

In short, there are different techniques to write in the memory of another process.  This allows bad code to run in what is otherwise a good process, and so you make that good process do bad things.  The memory rules block the access requests to access into memory in various ways, such as PROCESS_VM_WRITE and SET_THREAD_CONTEXT.  This is a pretty common attack technique, so these rules just shut that down.

Dave

[dilan90]

Hi @Daveb3d,

Thanks for the explanation of those rules. I sorted out some areas in ENS policies.  

Thanks

Dilan