{"id":47037,"date":"2017-10-24T14:30:19","date_gmt":"2017-10-24T21:30:19","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=47037"},"modified":"2017-11-01T22:41:53","modified_gmt":"2017-11-02T05:41:53","slug":"palo-alto-networks-protections-bad-rabbit-ransomware-attacks","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2017\/10\/palo-alto-networks-protections-bad-rabbit-ransomware-attacks\/","title":{"rendered":"Palo Alto Networks Protections Against Bad Rabbit Ransomware Attacks"},"content":{"rendered":"<p><span style=\"font-size: 18pt;\">What Happened<\/span><\/p>\n<p>On Tuesday, October 24, a new variant of ransomware called Bad Rabbit began spreading throughout Eastern Europe. These attacks reportedly impacted multiple organizations in Russia, Ukraine, Turkey, and other countries within the region. Our Next-Generation Security Platform automatically created, delivered and enforced protections from this attack.<\/p>\n<p>Bad Rabbit gains initial entry by posing as an Adobe Flash update. Once inside a network it spreads by harvesting credentials with the Mimikatz tool as well as using hard coded credentials. Bad Rabbit is similar to Petya\/NotPetya insofar as it encrypts the entire disk. For a detailed\u00a0analysis on the Bad Rabbit attack playbook, please see our blog from the <a href=\"https:\/\/www.paloaltonetworks.com\/blog\/2017\/10\/threat-brief-information-bad-rabbit-ransomware-attacks\/\">Unit 42 threat research team<\/a>.<\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-size: 18pt;\">Preventions<\/span><\/p>\n<p>Palo Alto Networks customers are protected through our Next-Generation Security Platform, which provides prevention through automation, applied consistently across the network, endpoint and cloud.\u00a0Palo Alto Networks customers are protected from Bad Rabbit ransomware through multiple complementary prevention controls across the platform, including:<\/p>\n<ul>\n<li><strong>WildFire\u00a0<\/strong>classifies all known samples as malware, automatically blocking malicious content from being delivered to users.<\/li>\n<li><strong>AutoFocus\u00a0<\/strong>tracks the attack for threat analytics and hunting via the\u00a0<a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.BadRabbit\">Bad Rabbit tag<\/a>.<\/li>\n<li><strong>Threat Prevention<\/strong>\u00a0enforces protections for malicious payloads and DNS activity, including:\n<ul>\n<li>Antivirus signatures:\n<ul>\n<li>Unique Threat IDs: 187795407 and 187792728, as well as Trojan\/Win32.ransom.pme\u201d and \u201cTrojan-Ransom\/Win32.gen.eian\u201d signature names.<\/li>\n<\/ul>\n<\/li>\n<li>DNS signatures:\n<ul>\n<li>Unique Threat ID: 187797549<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><strong>URL Filtering\u00a0<\/strong>blocks all known injection URLs.<\/li>\n<li><strong>GlobalProtect\u00a0<\/strong>extends WildFire and Threat Prevention protections to ensure consistent coverage for remote locations and users.<\/li>\n<li><strong>Traps<\/strong> uses its multi-method approach to prevent the malware from being executed on the endpoint automatically via integrated threat analysis and sharing with WildFire.<\/li>\n<li><strong>Block Portable Executables (PEs)\u00a0<\/strong>according to file blocking best practices, preventing malicious payload being delivered to users.<\/li>\n<li><strong>Multi-Factor Authentication (MFA)\u00a0<\/strong>can stop the usage of valid credentials, which were potentially leveraged to infect additional systems across the network.<\/li>\n<\/ul>\n<p><strong>NOTE: <\/strong>We are continuously monitoring the Bad Rabbit situation and will update this post with additional details on protections as they arise.<\/p>\n<p>For best practices on preventing ransomware with the Palo Alto Networks Next-Generation Security Platform, please refer to our\u00a0<a href=\"https:\/\/live.paloaltonetworks.com\/t5\/Featured-Articles\/Best-Practices-for-Ransomware-Prevention\/ta-p\/74148\">Knowledge Base article<\/a>. We strongly recommend that all Adobe users take additional steps to protect themselves by only getting Adobe Flash updates from the Adobe web site. For the latest on the Bad Rabbit attack playbook, please see the <a href=\"https:\/\/www.paloaltonetworks.com\/blog\/2017\/10\/threat-brief-information-bad-rabbit-ransomware-attacks\/\">Threat Brief: Information on Bad Rabbit Ransomware Attacks post<\/a>.<\/p>\n<p>Version Summary<\/p>\n<p>October 24, 2017 2:30 p.m. PT<\/p>\n<ul>\n<li>Initial Publication<\/li>\n<\/ul>\n<p>October 25, 2017 11:00 a.m. PT<\/p>\n<ul>\n<li>Added details on Traps<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Palo Alto Networks protections against Bad Rabbit ransomware.<\/p>\n","protected":false},"author":356,"featured_media":46890,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[108],"tags":[4752,221],"coauthors":[3770],"class_list":["post-47037","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-prevention-2","tag-bad-rabbit","tag-ransomware"],"jetpack_featured_media_url":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-content\/uploads\/2017\/10\/social-graphic-temp-Sept-PT-Linkedin-698x400.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/47037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/356"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=47037"}],"version-history":[{"count":10,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/47037\/revisions"}],"predecessor-version":[{"id":48657,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/47037\/revisions\/48657"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/46890"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=47037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=47037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=47037"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=47037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}