2

In my company (And many others around the world) there is a wide usage by tech teams of tools such as ipscanners, psexec, pskill and other tools.

How do you deal or control the usage of such tools in your environment?

It's common for threat actors after an intrusion to use internal administration tools that are already available within servers and workstations, I would like to prevent.

4

If you're worried about malicious actors using standard user internal utilities (psexec, pskill) after gaining access to a system, you're worrying about a scenario where no matter what actions are taken in preparation for the intrusion, the attacker will be able to circumvent it, as they already have access to the machine. Making it more difficult to use some of the "power-user" oriented tools on the system will only make it more frustrating for your legitimate users to do their jobs, and won't do anything to prevent the attacker other then mildly inconveniencing them.

However, if you're concerned about tools and utilities that require root/admin level access being used by the attacker after intrusion, you should look into securing your user system (e.g. only giving sudo/admin level access to users signing in with PGP (or if Windows, only from local logins), or only allowing local access to root (only applicable to Linux), etc) instead of trying to limit the tools available in your userspace.

  • Totally agree, but it wouldn't also hurt to set file permissions on the folders containing said tools so that they can't be accessed by your typical HR rep's compromised details for instance and so actually does require a slightly more privileged account... but totally agree it will likely only slow down an attacker. A Software Restriction Policy / AppLocker wouldn't hurt on unprivileged users too so long as it works for your organisation (users don't need to run random EXEs etc.). Also, log log log! – Matthew1471 Jan 19 '17 at 13:13
0

The most effective thing that can be done to mitigate the use of these types of tools internally is to create a strong Acceptable Use Policy. Then, once approved by deciding authorities, enforce it by having employees sign it.

You should have two AUP documents in place, one for regular end-users, and one (or an additional one) for IT users. This allows you to control which users are allowed to have these types of tools installed.

If you are worried about these types of tools being used against your own network internally, I would recommend full-disk encryption on the machines that have them installed, and have the users shut the machines down after business hours are over.

If you are looking for a technical resource, I would recommend application white-listing. In our organization, we simply use a spice works report once daily to let us know about any applications on our network. Though not a complete solution, it helps us stay on top of things.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.