SHAREMONITOR SETUP GUIDE

Size: px

Start display at page:

Download "SHAREMONITOR SETUP GUIDE"

Evangeline Floyd
5 years ago
Views:

1 SHAREMONITOR A ransomware encryption monitor for server shared folders. SETUP GUIDE Page 1 of 22 Copyright ABit Consulting 2016

2 TABLE OF CONTENTS Document Revisions... 4 Installation... 5 Registration... 5 How does it work?... 6 Actions... 8 Stop File and Printing Sharing and Volume Shadow Copy... 8 Rename / Delete File Share Message Event Log Configuration General Service Control Actions Options Monitor Options Action Options Lists Ignored Shares Blacklist Filenames Whitelist Filenames Terminate Applications Terminate Services SMTP Server Threat Recover Starting Services Page 2 of 22 Copyright ABit Consulting 2016

3 Renaming shares Page 3 of 22 Copyright ABit Consulting 2016

4 DOCUMENT REVISIONS Revision Changes Reviewer 1 Original Version TM 2 Version changes TM 3 Version changes TM 4 Version changes TM 5 Version changes TM 6 Version changes TM 7 Version changes TM 8 Version changes TM 9 Version changes TM Page 4 of 22 Copyright ABit Consulting 2016

REGISTRATION Please provide ABit Consulting with your activation key and contact details.

5 INSTALLATION Follow the installation prompts to install ShareMonitor and any prerequisites. The Configuration tool will be launched after installation. REGISTRATION Please provide ABit Consulting with your activation key and contact details. We will provide a registration key. Your registration and expiry date will appear in the about dialog. Page 5 of 22 Copyright ABit Consulting 2016

When these files and folders are created they are

6 HOW DOES IT WORK? Sharemonitor enumerates all windows shares present on a Windows File Server A honeypot folder and file is placed in the root of each share. When these files and folders are created they are given EVERYONE permission to ensure it could be infected. Page 6 of 22 Copyright ABit Consulting 2016

modification but will monitor that the change did

If the file is renamed (eg sharemonitor.doc.

ShareMonitor also inspects know file types and

7 If the file is modified or renamed. ShareMonitor will notice this modification and react according to its setup. ShareMonitor does not just react to any modification but will monitor that the change did not change the GUID value. If the file is renamed (eg sharemonitor.doc.encrypted) this will also trigger alert actions. ShareMonitor also inspects know file types and checks they are valid. Upon a specified number of failures within a time frame an alert will be triggered. Page 7 of 22 Copyright ABit Consulting 2016

8 ACTIONS STOP FILE AND PRINTING SHARING AND VOLUME SHADOW COPY If configured ShareMonitor will stop File and Printer sharing and Volume Shadow Copy. Shares will become unavailable. Page 8 of 22 Copyright ABit Consulting 2016

RENAME / DELETE FILE SHARE If the option to rename / delete a share is enable the

Upon detection of an issue, the share is renamed or removed.

The share is appended with specific suffix if rename option is selected.

9 RENAME / DELETE FILE SHARE If the option to rename / delete a share is enable the following will occur: File shares are monitored. Upon detection of an issue, the share is renamed or removed. The share has been removed and is no longer available. The share is appended with specific suffix if rename option is selected. This allows other file shares to remain active. If ShareMonitor fails to remove the share is will fall back to stopping all shares. Page 9 of 22 Copyright ABit Consulting 2016

EMAIL MESSAGE ShareMonitor can also send email alerts.

10 MESSAGE ShareMonitor can also send alerts. The alert will provide: - File and share details - Stopped services and processes - List of open shared files on the server sorted by username. Page 10 of 22 Copyright ABit Consulting 2016

11 EVENT LOG ShareMonitor creates entries in the Windows Event Lot Page 11 of 22 Copyright ABit Consulting 2016

CONFIGURATION GENERAL SERVICE CONTROL Share Monitor File and Printer Sharing Volume Shadow Copy Controls the Share Monitor Service. Settings will be saved prior to starting.

12 CONFIGURATION GENERAL SERVICE CONTROL Share Monitor File and Printer Sharing Volume Shadow Copy Controls the Share Monitor Service. Settings will be saved prior to starting. Control the Microsoft Windows Server service (LanmanServer and Browser services) Control the Microsoft Windows VSS service. ACTIONS Stop file sharing Stop Volume Shadow Copy Send Alerts Terminate Applications Terminate Services File shares will be renamed, deleted or stopped upon threat detection. Upon threat detection, the Volume Shadow Copy service will be stopped to prevent previous version from being corrupt. alerts will be sent. Listed applications will be terminated on threat detection. (eg dropbox.exe) Listed services will be terminated on threat detection. Any service dependencies will also be terminated. Page 12 of 22 Copyright ABit Consulting 2016

$This depends how hidden shares are utilised or mapped in your company setup. Shares based in the Windows folder (eg C:\Windows\system32) are not monitor.$ Generally, these shares are for system use and read-only. The name of the folder placed in the root directory of each share. This is Monitor Filename generated randomly after installation.

Generally, these shares are for system use and read-only. The name of the folder placed in the root directory of each share. This is Monitor Filename generated randomly after installation.

13 OPTIONS A unique monitor folder and filename is recommended. MONITOR OPTIONS Ignore Hidden Shares Ignore Windows Folders Monitor Folder Hidden shares (eg SHARE$) will not be monitored. This depends how hidden shares are utilised or mapped in your company setup. Shares based in the Windows folder (eg C:\Windows\system32) are not monitor. Generally, these shares are for system use and read-only. The name of the folder placed in the root directory of each share. This is Monitor Filename generated randomly after installation. Use the button to generate a new name or create your own. This name of the honeypot file placed in monitor folder. This is generated randomly after installation. Use the generate a new name or create your own. button to Page 13 of 22 Copyright ABit Consulting 2016

14 Inspect known file content Know file types (eg Word / Excel) content is inspected, if it appears invalid encryption is suspected. Eg If 5 (fail count) files are modified / created and appear encrypted within 30 seconds, encryption is suspected and actions specified will be executed. Inspect know file renames Know file types (eg Word / Excel) file renames are monitored. If the extension changes for the specified max count, within the time frame specified in reset seconds, encryption is suspected and actions specified will be executed. Page 14 of 22 Copyright ABit Consulting 2016

15 ACTION OPTIONS Rename / delete shares Shares will be renamed if a suffix is supplier otherwise share will be removed. Files are not removed. Uncheck this option to stop file share services. Set renamed max users to 1 When a share is renamed the max user value will be set to 1. Rename suffix String to append to shared folder (eg \\server\share will become \\server\share_sm$) Leave suffix empty to just remove share. Page 15 of 22 Copyright ABit Consulting 2016

LISTS IGNORED SHARES A list of Shared Folders that are ignored. It is recommended to also keep the default variable {default}. BLACKLIST FILENAMES A list of blacklisted filenames with wildcards.

16 LISTS IGNORED SHARES A list of Shared Folders that are ignored. It is recommended to also keep the default variable {default}. BLACKLIST FILENAMES A list of blacklisted filenames with wildcards. If a new variant has been detected update the list here. It is recommended to also keep the default variable {default}. WHITELIST FILENAMES TERMINATE APPLICATIONS TERMINATE SERVICES A location or file that can contain blacklisted filenames. Generally this should not be used but if a software products creates files with the same extension as black listed files a location could be ignored. It is recommended to also keep the default variable {default}. Listed executable names will be terminated. (eg dropbox.exe, onedrive.exe, owncloud.exe) Stopping cloud upload application to stop encrypted files being uploaded. It is recommended to also keep the default variable {default}. Listed service names will be stopped along with any dependencies.it is recommended to also keep the default variable {default}. Page 16 of 22 Copyright ABit Consulting 2016

EMAIL SMTP SERVER Server Server or IP address of SMTP server Port SMTP server port, generally 25 or 587 Username / Password From Address Recipients Subject Specify a username and password SMTP

17 SMTP SERVER Server Server or IP address of SMTP server Port SMTP server port, generally 25 or 587 Username / Password From Address Recipients Subject Specify a username and password SMTP authentication is required. The address the alert message are sent from. List of alert recipients separated by the ; character. Eg fred@company.com;joe@company.com Alert subject, allows you to enter the server name or another identifier in the event you are running ShareMonitor on multiple sites. Page 17 of 22 Copyright ABit Consulting 2016

Renames share folder (default _SM$) appended Stops File and Printer sharing (if repeated detections for rename share fails) If file and printer sharing is stopped; you may not be able

18 THREAT RECOVER After a threat detection or false positive some steps will need to be taken, depending on the actions configured. By default, ShareMonitor performs the following actions in the event of a detected threat. Renames share folder (default _SM$) appended Stops File and Printer sharing (if repeated detections for rename share fails) If file and printer sharing is stopped; you may not be able RDP without using admin (console) depending how long the service has been stopped. To start Remote Desktop in Admin mode. Run mstsc /admin The reason is stopping Windows File and Printer sharing also stops some other services (starting Server (LammanService) will start these dependencies) Page 18 of 22 Copyright ABit Consulting 2016

STARTING SERVICES Before enabling the services; we would strongly advise to check event log and suspected folders to ensure it is a false positive before starting file and

19 STARTING SERVICES Before enabling the services; we would strongly advise to check event log and suspected folders to ensure it is a false positive before starting file and printer sharing. Once you are prepared to start the services again; start share monitor and click start in File and Printer Sharing. Page 19 of 22 Copyright ABit Consulting 2016

20 RENAMING SHARES Locate and shares renamed by share monitor. Open the folder location and select properties -> sharing -> advanced settings Page 20 of 22 Copyright ABit Consulting 2016

21 Click Add Create a new share and update permissions as required. Page 21 of 22 Copyright ABit Consulting 2016

22 Remove the SM$ share Page 22 of 22 Copyright ABit Consulting 2016

This Quick Start describes how to use Bocconi Cloud Service, called Filr in the rest of the document, from your Windows desktop.

This Quick Start describes how to use Bocconi Cloud Service, called Filr in the rest of the document, from your Windows desktop. Quick Start Bocconi Cloud Service, based on Novell Filr, allows you to easily access all your files and folders from your desktop, browser, or a mobile device. In addition, you can promote collaboration