Kaseya Ransomware Attack

[Daveb3d]

For anyone not away who uses this...

https://www.reddit.com/r/msp/comments/ocggbv/crticial_ransomware_incident_in_progress/ 

ATP will stop it via a JTI rule based upon the command used per the link, but if you don't have it deployed the following will block the command:

Rule {
    Process {
		Include DESCRIPTION { -v "CertUtil.exe" }
		Exclude OBJECT_NAME {
			-v "%windir%\\System32\\certutil.exe"
			-v "%windir%\\SysWOW64\\certutil.exe"
		}
	}
    Target {
        Match SECTION {
            Include OBJECT_NAME { -v "**" }
			Include -access "CREATE"
        }
    }
}

[bodysoda]

Do the AMCore detect this kaseya threat? 

[SaiVishnu]

@Daveb3d @bodysoda 
The IOC indicators which is mentioned in the article. We have checked all the three hashes and McAfee has already detection from GTI Server ( Global Threat Intelligent Server). If the GTI is enabled then it should detect the below three hashes.

MD5 Hashes :

561cffbaba71a6e8cc1cdceda990ead4

7ea501911850a077cf0f9fe6a7518859

a47cf00aedf769d60d58bfe00c0b5421

[yaz · Accepted solution]

Hi all,

Please find the Coverage information below. 

https://kc.mcafee.com/corporate/index?page=content&id=KB94660

Was my reply helpful?

If yes, please give me a Kudo. If I have answered your query, kindly mark this as solution so that together we help other community members. 

[bodysoda]

Thanks, @yaz @SaiVishnu . Subscribed to the SNS notice and ExtraDAT has been deployed in our environment.