You’ve often heard us say “protect while you collect” and now Elastic has made this
possible with protection from ransomware attacks.
Ransomware attacks have increased and plagued business operations that affect everyday life.
Let’s learn how Elastic’s ransomware protection is enabled and how it uses behaviors, not
signatures, to stop threats at scale.
Enabling Ransomware protection is easy.
Ransomware protection is part of the Elastic Endpoint Security Integration with Elastic
Agent and is available for users with a Platinum license.
Starting from the Overview tab in Elastic Security, first navigate to the Administration
page.
Next, click on the policy listed under the Integration Policy column located in the Endpoint
section.
In our example, the policy is named endpoint.
Your policy name will be different based on what you called it during the creation of
the policy.
This screen brings you to the current configuration for this policy.
Under Protections you can see that Malware and Ransomware are currently enabled.
From this screen you can adjust the protection level to either Detect or Prevent.
For ransomware protection it is highly encouraged to set the protection level to Prevent.
Next, enable or disable the user notification message and customize the notification message.
Scroll down and save your changes.
That’s it! Now Ransomware protection is set for your Windows Endpoints.
Now let’s discuss how ransomware protects your network.
Elastic Security employs a layered strategy for defense.
Starting with the Elastic Endpoint integration within Elastic Agent, machine learning malware
models are used to classify and alert on malicious files.
These models are remarkably accurate at identifying ransomware pre-execution and alerting on the
malicious files based on machine learning analysis, not signatures.
Ransomware protection is used as an additional measure to prevent files from being encrypted
during an attack post-execution.
We will expand on this in a moment.
Once data is sent from the endpoint to the Elastic cluster, free and open detection rules
evaluate and alert on observed behaviors.
These steps reduce mean time to response and protect your network.
Let’s take a closer look at how ransomware protection within the Elastic Endpoint Security
Integration works.
The ransomware protection starts post-execution of a file and analyzes file modifications
to determine if it is ransomware or not.
The key characteristics examined are file header mismatches, extensions being added
to files, and inspection of entropy ranges.
Let’s dig a bit deeper into each of these characteristics
File header mismatches are when the magic byte sequences of a file don't match what
is expected.
For example, in our sample here, the icon and name without extensions appears to be
a word document.
However, once an extension is added, it is masquerading as a word document with an executable extension.
Extensions being added to a large number of files in a short amount of time.
For example, the 8-character string appended to files encrypted with Darkside ransomware.
Lastly, file entropy ranges are based on the “density” based on file type.
Say text files shouldn’t have high entropy and having high entropy could indicate a file
is packed, a tactic often used by ransomware authors.
Thanks for watching this deep dive on Elastic Security’s ransomware protection.
In this video, we covered how Elastic’s ransomware protection uses behaviors, not
signatures, to protect your environment and how to enable ransomware protection.
If you’re ready to dive deeper into Elastic Security, start your Elastic Security Quick
Start today with your free trial of Elastic Cloud.