Endpoint Standard: What are the Recommended Rules for Preventing and Detecting RYUK Ransomware?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

What are the Recommended Rules for Preventing RYUK Ransomware?

Environment

• Carbon Black Cloud: All Versions (formerly Predictive Security Cloud)
  • Endpoint Standard

Resolution

PROCESS	OPERATION ATTEMPT	ACTION
Known Malware	Runs or is Running →	Terminate
Suspect Malware	Runs or is Running →	Terminate
Not listed application	Performs ransomware-like behavior →	Terminate
Unknown application or process	Performs ransomware-like behavior →	Terminate
**\psexec.exe	Runs or is running →	Terminate
**\psexesvc.exe	Runs or is running →	Terminate
**\Users\*\AppData\Local\*\*.exe	Runs or is running →	Terminate
C:\users\public\**	Runs or is running →	Terminate
**\cmd.exe	Executes a fileless script →	Terminate
**\cmd.exe	Executes code from memory →	Terminate
**\cmd.exe	Invokes a command interpreter →	Deny
**\runtimebroker.exe	Invokes a command interpreter →	Deny
**\powershell.exe	Invokes a command interpreter →	Deny
**\powershell.exe	Executes a fileless script →	Terminate
**\powershell.exe	Executes code from memory →	Terminate
**\bitsadmin.exe	Runs or is running →	Terminate
**\icacls.exe	Runs or is running →	Terminate
**\schtasks.exe	Runs or is running →	Terminate

If "psexec" is required to run:

**\psexec.exe →	Communicates over the network →	Deny/Terminate
**\psexesvc.exe →	Communicates over the network →	Deny/Terminate

Additional Information

Ryuk in the past was prevented and detected across products by using: https://community.carbonblack.com/t5/Threat-Research-Docs/TAU-TIN-Ryuk-Ransomware/ta-p/45904

VMWare Carbon Black recommends testing new rules in a test environment,  ideally prior to mitigating an outbreak, in order to prevent adverse effects in a production environment.