5

I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say without admin privileges, the ransomware wouldn't be able to install the fake flash update/mimikatz?

Any other pointers we need to look out for, other than the ones for WannaCry, Petya, NotPetya?

  • 1
    Good idea blocking the IOCs. I would also use AppLocker or a SRP via GPO to block any potential variant. – SamAndrew81 Oct 25 '17 at 1:47
2

First of all inform/warn employees from your organization - not to click on fake flash installation pop-up windows.

Here is an example:

enter image description here

On welivesecurity.com it is said:

One of the distribution method of Bad Rabbit is via drive-by download. Some popular websites are compromised and have JavaScript injected in their HTML body or in one of their .js file.

That's from user perspective, now take technical advice:

  • keep your software/OS up-to-date
  • use strong passwords
  • block traffic on SMB protocol (tcp/445)
  • use AntiVirus software
  • monitor scheduled tasks and service creation

And as @Royce Williams said, you can create following files:

c:\windows\infpub.dat && c:\windows\cscc.dat

and remove ALL PERMISSIONS (inheritance).

You can also block access to following compromised sites from this list - https://pastebin.com/raw/n7ExrTsJ

More info about badrabbit follow here.

0

One specific additional countermeasure is to vaccinate, using this procedure to create a couple of specific files:

C:\Windows\infpub.dat
C:\Windows\cscc.dat

... and then remove permissions inheritance from them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.