Which rule number in IPS will protect Ransomaware - Reyptson

[thaungtunzaw]

Hello,

I would like to ask that to protect Reyptson Ransomware, which rule number need to disable?

Thanks.

[Marvin Rhoads]

The Indication of Compromise (IOC) for Reytson is a malware file with SHA-256 hash of 

e6d549543863cd3eb7d92436739a66da4b2cc1a9d40267c4bb2b2fa50bf42f41

I got that information from:

http://www.securitynewspaper.com/2017/07/18/reyptson-ransomware-spams-friends-stealing-thunderbird-contacts/

That file would be detected as malware by an AMP file policy - not an IPS rule. So if you have AMP for Networks or AMP for Endpoints you would be protected.

I put the hash in my AMP console and confirmed that it has been identified by malware since 17 July based on multiple behavioral indicators from the Threatgrid sandbox.