This is Susan Bradley for CSO Online recently there have been several reports of fake updaters
that pretend to be browser landing pages that spoof Chrome Firefox and Internet Explorer
and probably even edge when the user clicks on the upgrade option a javascript file is
downloaded and executes the malware here's an example here where wasted locker use this soc
goalish framework so it delivered a victim a zipped file via compromised legitimate websites it
contained malicious javascript masquerading as a browser update so what can you do to prevent these
kinds of ransomware attacks well obviously there's plenty first off i hope no one actually receives
dot js or dot jse files at the email gateway level there's no logical reason for any user in your
environment to be receiving or emailing javascript files to a normal average user or workstation
you should also while you're at it review the file types that you block on a regular basis
and ensure that only those file types you want are allowed so look at your firewalls
your email file transfer types any other means that files come into and out of your office
make sure you review everything on a regular basis to make sure it's what your policies should be
next do something i call the poor man's protection you can go into default apps by file type
and reassign.json.js to different file types for example rather than the default of the
windows based script host you can change it and actually go to something like notepad
if you have access to intune you can go into devices configuration profiles
platform of windows 10 or later choose endpoint protection you want to create the policy
i'm going to call it i'll just call it test for now
and you want to come down here to microsoft defender
exploit guard and you want to go to attack surface reduction
and you can see down here
you can rules to prevent script threads you can configure that
now initially you may want to click on audit only
in your environment you may want to test it and then later on come back and change it to block
and while you're here in intune if you have access to this you can look at all of your
other options you have attack surface reduction rules are very powerful and especially in
intune they're very much easier to to review if you're familiar with the group policy settings
for attack surface reduction you'll remember that you have to use grid codes in order to enable them
so it can be a little bit daunting this is a lot easier to understand what you're
enabling and disabling an environment last but certainly not least you can use powershell
as you can see you can do the set mp preference turn on the attack surface reduction rules this
is the grid code specifically for the blocking of the js and you want to enable it get the idea
that there's lots of ways that you can block scripting in your inside your environment
take the time to fully understand all of the different controls and abilities you
have in your environment many times you don't have to buy new licenses you already have the
power inside your own system until next time this is susan bradley for cso online