I have installed a SIEM on my company that is based on Alienvault USM correlation rules. How can I detect Ransomware activity on my network?

I already enabled Suricata IDS on all of my network traffic.

closed as too broad by Steffen Ullrich, Anders, Matthew, Steve, Xander May 8 '17 at 14:08

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    This is like I've bought a car, how do I drive? - i.e. too broad. – Steffen Ullrich May 8 '17 at 11:52
  • Ransomware is a client-focused activity and might not touch the network. Are you sure you are using the correct tools for this threat? – schroeder May 8 '17 at 11:55
  • no its not broad I think. for example one solution is using FIM on files and check if there is any change on file volume. – ali tavakoli May 8 '17 at 11:56
  • Yes Ransomware is client-focused but some activities like connecting to attacker C&C server could be detected via NIDS. – ali tavakoli May 8 '17 at 11:58

Using a SIEM solution to monitor ramsonware is fairly simple. Explaining it in a high level: If you enable "file audit" logs on your OS you will receive logs every time a file is changed. Ransomware basically encrypts (changes) several files in a very short period of time. Based on that, you can create a rule in your SIEM to detect this burst in "file changed" events and generate a incident once a threshold is reached.

Something like this: "If there are more than 500 file modification events in less than 5 minutes for the same log source, create an incident".

It is important to mention that enabling "file audit" logs can increase considerably your EPS rate. In my opinion, enabling file audit brings a lot of monitoring capabilities (and help a lot in forensic cases), but keep in mind the EPS increase. For this reason, I do recommend you to implement in this in phases. For example, first enable the file audit logs to 10-15 computers and analyse the EPS increase. In the second phase, more 40-50 computers.. and so on..

Also, you should activate intelligence feeds into your SIEM. Those feeds contain "blacklists" of Command&Control servers, so if any of your computers connect to those C&C servers you will get an alert.

If you want to learn more about this topic, I wrote a post in my blog about this. It's more focused on IBM QRadar, but you can easily adapt to any SIEM solution.

Not the answer you're looking for? Browse other questions tagged or ask your own question.