topic Signature Update S842.0 in Network Security

IPS | Petya Ransomware

John — Sun, 10 Mar 2019 13:52:18 GMT

Hello Team,

We would like to know what signature we need to update on our IPS for us to mitigate the petya ransomware?

New Ransomware Variant

Leo Laohoo — Wed, 28 Jun 2017 21:02:31 GMT

New Ransomware Variant "Nyetya" Compromises Systems Worldwide

Hello Leo,

John — Wed, 28 Jun 2017 23:22:13 GMT

Hello Leo,

How about in IPS we're using Cisco Intrusion Prevention System, Version 7.1(8p1)E4

Host:
Realm Keys key1.0
Signature Definition:
Signature Update S842.0
OS Version: 2.6.29.1
Platform: ASA5525-IPS

what version of signature that we need to upgrade for us to mitigate na ransomware?

Signature Update S842.0

Leo Laohoo — Thu, 29 Jun 2017 00:37:27 GMT

Signature Update S842.0

That's a pretty old signature file. The latest one is S987 (Release Date 22 June 2017).

Signature file S982 has been released to address WannaCry/WannaCrypt so I'd say signature file S842 is not covered.

Hi John

#TCN — Mon, 03 Jul 2017 09:05:08 GMT

Hi John

please see below link and snort rules you can enable, depending on your base policy the rules may or may not be enabled.

On Firesight Manager you can enable these rules to drop / alert or just alert (via policies > intrusion)

http://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html

42944 - OS-WINDOWS Microsoft Windows SMB remote code execution attempt
42340 - OS-WINDOWS Microsoft Windows SMB anonymous session IPC share access attempt
41984 - OS-WINDOWS Microsoft Windows SMBv1 identical MID and FID type confusion attempt

5718 - OS-WINDOWS Microsoft Windows SMB-DS Trans unicode Max Param/Count OS-WINDOWS attempt
1917 - INDICATOR-SCAN UPnP service discover attempt
5730 - OS-WINDOWS Microsoft Windows SMB-DS Trans Max Param OS-WINDOWS attempt
26385 - FILE-EXECUTABLE Microsoft Windows executable file save onto SMB share attempt
43370 - NETBIOS DCERPC possible wmi remote process launch

@Jim B

Marvin Rhoads — Mon, 03 Jul 2017 13:41:01 GMT

boydjames

Snort rules are for FirePOWER appliances or modules in the Cisco world.

The OP indicated he is running the classic Cisco IPS (with a VERY old signature file).

Thus Leo's advice was correct.