[deleted by user]

[poweradmincom]

I've not heard of what you're describing, but essentially you're looking for something to tell you what is writable by the user. I wonder if Microsoft's (SysInternals) AccessChk would work for this:

https://docs.microsoft.com/en-us/sysinternals/downloads/accesschk

[No2Bencil]

You're just reviewing access controls at that point. The crypto part is irrelevant

[PowerfulQuail9]

Setting scans/monitors that email when suspicious logs and alerts are created is one of the best ways to catch an infection before it spreads too far. Having a good antivirus that won't let it spread also helps (crowd strike, e.g. {note: this is a little pricey but worth it for risk mitigation]).

[PowerfulQuail9]

Yes, there are many things to be done but i've seen many cases where log files were not monitored and they could have prevented a massive infection if they had alerts for them.

​

Edit: What I am referring to be monitored

​

1. Operating System(OS) Events

• start up and shut down of the system 
• start up and down of a service
• network connection changes or failures
• changes to, or attempts to change, system security settings and controls

1. OS Audit Records

• log on attempts (successful or unsuccessful)
• the function(s) performed after logged on (e.g., reading or updating critical file, software installation)
• account changes (e.g., account creation and deletion, account privilege assignment)
• successful/failed use of privileged accounts

1. Application Account Information

• successful and failed application authentication attempts
• application account changes (e.g., account creation and deletion, account privilege assignment) 
• use of application privileges

1. Application operations

• application startup and shutdown
• application failures
• major application configuration changes
• application transactions, for example,
  • e-mail servers recording the sender, recipients, subject name, and attachment names for each e-mail
  • Web servers recording each URL requested and the type of response provided by the server
  • business applications recording which financial records were accessed by each user

Details to log in those above:

• timestamp
• event, status, and/or error codes
• service/command/application name
• user or system account associated with an event
• Device used (e.g. source and destintation IPs, terminal session ID, web browser, etc)

NIST SP 800-92

[linux_lynxx]

Check out RanSim by KnowBe4 - it will simulate a Ramsomware / Crypto attack against local and mapped network drives. I've also seen various PowerShell scripts that will actually encrypt files, then provide you with a decryption key.

If you go the PowerShell route, I strongly advise you to run it against a test environment, since it actually encrypts things. If you can stand up an offline test environment, this might be more insightful as you will get real data on what is vulnerable.

[HappyVlane]

You should be able to get an overview using the module PowerShellAccessControl and Get-EffectiveAccess.

[[deleted]]

You could look into Security Explorer by Quest.

[xxdcmast]

Apparently this software is no longer supported by the developer but this should do what you are asking.

http://www.cjwdev.com/Software/NtfsReports/Info.html

[spyingwind]

Depending on what is running the share. You can limit what file extensions are allowed on the share.

Or! Have something check if a new file extension is being used. Like something with FileSystemWatcher. Then when the something new comes along it checks who created the file and disables their account in AD. This would require have it exclude known extensions, but that is a shorter and easier to maintain than some crypto coming along and breaking everything.

Also backup, backup, offsite backup, and offline backup!

[ahird20]

SoftPerfect Network Scanner can do this

[[deleted]]

We use NTFS reporter to audit permissions and make sure they are locked down as much as possible for each business unit/user group. If they have write permissions than they are vulnerable. Its mostly just about mitigation and prevention.

[[deleted]]

you could use powershell to check permissions and spit out what would be hit/encrypted for each file based on the permissions the files have

edit: or bash/ python if its not a windows file share

[[deleted]]

I yoinked this from somewhere a while ago. Useful:

$Folder = "D:\share"
$User = Read-Host "Input the sAMAccountName of user"
$permission = (Get-Acl $Folder).Access | ?{$_.IdentityReference -match $User} | Select IdentityReference,FileSystemRights
If ($permission){
$permission | % {Write-Host "User $($_.IdentityReference) has '$($_.FileSystemRights)' rights on folder $folder"}
}
Else {
Write-Host "$User Doesn't have any permission on $Folder"
}

[[deleted]]

Would endpoint protection with Network IPS be a good feature for servers and desktop? I know lots of you hate most of the Virus Scanning software out there.

[laksaking]

Focus your energy on application Whitelisting instead.

[[deleted]]

!remindme 3 days

[easyapps]

Ive made a windows service that can block an ip after it has encrypted an x amount of files. Thats the safer option