There are many sources of motivation for hackers and bad actors to do what they do, but ransomware attacks are driven by two primary motives; money and destruction. However, even though there are dozens of ransomware variants with new mutations being discovered weekly, they all exhibit the same common behavior; large volumes of file modifications in short periods of time. If you’re going to do this, you need to detect unusual or abnormally high file system activity in short timeframes as well as operations associated with ransomware presence such as the creation of files with specific names and file extensions. Monitor all file activity on all your critical file systems, send the data to your SIEM, write rules looking for the aforementioned patterns, and hope you find your attacker.
Or, stay tuned for a better solution from STEALTHbits…
Don’t miss a post! Subscribe to The Insider Threat Security Blog here:
Adam Laub is the Senior Vice President of Product Management at STEALTHbits Technologies. He is responsible for setting product strategy, defining future roadmap, driving strategic sales engagements, supporting demand generation activities, enabling the sales organization and all aspects of product evangelism.
Since joining STEALTHbits in 2005, Adam has held multiple positions within the organization, including Sales, Marketing, and Operational Management roles.
Adam holds a Bachelor of Science degree in Business Administration from Susquehanna University, Selinsgrove, PA.