When malware is detected on a device, Sophos Intercept X Advanced
will generate an event. The event will include the detection type, some
application information for the file that it was the detection occurred on,
and in some cases it'll include raw data. This raw data often includes the
processed trace for the application. This information is useful for an
administrator in understanding if the attack is very isolated, or was part of
something more sophisticated. It's important to note that process trace
information is currently only available for detections based on Intercept X, so
application lockdowns, exploit detections, ransomware detection through Crypto-
guard, and active adversary mitigations. Other detection types that may become
from machine learning or signature based detections will not include this
process trace at the moment. Looking more closely at the process trace for this
Cryptoguard event, we can see that the application ransomgen.exe was
convicted. It had begun performing encryption on a set of rich text files.
Looking at the processed trace itself we can see that ransomgen was launched
from a script execution space WS script, with the command line to run a script
file called attack.vbs. The script file itself was launched from a command line
that was launched from PowerShell. This is very indicative that a further
investigation is required. Let's take a look at the Sophos console itself to see
what this would look like in the product. So here we're looking at a device called
victim 1. The victim 1 machine is a Windows 7 device it's being used by user
'test.' There are a number of events that have come in, some include details, others
don't. So you can see here a basic malware cleanup, there's no details
involved this other detection here though, for putty.exe does have
information. Again though, it's a clean up event. Looking at the details we can see
they're fairly sparse, the was simply cleaned. But if we go down to
our ransomware detection, the initial Cryptoguard detection for ransomgen.exe
and we look at details here. We can see the basic information. If this were a
false positive, and a known good application, I could go ahead and exclude
it from future detections by ransomware. But, let's take a look at the
raw details. And when we look at the raw details here we see something
indicative of a more sophisticated attack. We can actually see how ransomgen.exe
was launched. And in this case it was launched with a parameter, so we
can see the command line to run an exploit called ransomware server ransomgen
was initiated from the WS script executable, an operating system component,
with the command line to run a visual basic script file called attacked.vbs
that's located on the user's desktop. Furthermore this was run from a command
line that was run from PowerShell. Looking at the PowerShells command line
we can see that it was launched with a base64-encoded attack string. It's very
rare that legitimate administrator activity would include base64 encoding.
And even further back in the attack chain we can see that this was launched
from MSHDA, which means the user was browsing to
some location that involved an HTA application that was executed created a PowerShell, and
then from inside that PowerShell, a command line script was launched, an
attack script was then executed that included the ransomware. Even though
we've convicted ransomwaregen.exe as malware and removed it, we've seen the
cleanup of that, as an administrator I want to understand more. What else was
happening from that PowerShell in the command line. And we'll see that in a
moment when we look at the Sophos EDR capabilities.