Ransomware detection

[gelim]

Hello,

Thanks for this excellent repo, but I'm failing to see if there is any TTP related to ransomware activity that could trigger a detection on falcon Linux sensor?

Regards, -- Mathieu

[shawndwells]

Hi @gelim - this repo is just a subset of events for testing and demos. We could integrate a ransomware demo though. Do you have samples we could look at?

[shawndwells]

Found some - https://github.com/fabrimagic72/malware-samples/tree/master/Ransomware

[gelim]

Yes for instance, or the opensource https://github.com/tarcisio-marinho/GonnaCry that could be "defused", but still valid to asess any detection logic on the defense side.

[redhatrises]

GonnaCry or Satan could work for examples in the container.

[shawndwells]

@gelim Many of the cloud team at CrowdStrike are prepping for AWS re:Inforce and there may not be much movement on this for a few weeks. If you're interested & able, patches would be welcome!

[gelim]

If I find some code that trigger ransomware detection logic on Linux falcon sensor, I will update here. For the moment it seems there is only event dedicated to ransomware on the Windows platform.

For instance Gonnacry will be prevented by NGAV (This file meets the File Attribute ML algorithm's high-confidence threshold for malware.)

[shawndwells]

The GonnaCry should do the trick. Their README calls out being written for Linux - https://github.com/tarcisio-marinho/GonnaCry

[gelim]

As I mentioned previously the original binary is getting a prevention with a generic alert. Additionally a fresh build will not be prevented nor detected.