After looking at this behaviour, I pulled my favourite tools, one of them does not need any installation "netstat -ano", that gave me all the incoming SMB(TCP 445) connections to this machine and obviously source machines as well. After I saw that , I used tool called network monitor( netmon 3.4 ) . I filtered the traffic for SMB traffic and could clearly see the IP address, that I saw in netstat -ano output sending SMB traffic ,trying to create infection file in users profile folders. Earlier ,these were same locations admin was showing me, where infection was coming back again after removal.

So I suggested them to take me to the machine ,which was sending this SMB traffic and trying to create these files. When we went there, we found SCEP was disabled. They had a group policy that disabled it, obviously it was not detecting and cleaning since it was not running at all. So I again used network monitor on this machine, to analyse the behaviour of this machine. I ran following filter in netmon where filename.exe is the exe file, this malware was trying to create on the target machine. Here path is usual path this malware was trying to create these files on target machine.

SMB2.CCreate.Name == "ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\filename.exe"

The output of this in network monitor gave me list of other machines, this malware was trying to infect from this machine, it was a huge list of machines. Admin used that list to check the status of SCEP on those machines and if they are detecting and cleaning on those machines. Meanwhile they also got this machine out of those GPOs which disabled SCEP on it.

So if SCEP was running as usual on this HUB of malware :), this issue would not have occurred at all.

Even if we are seeing this behaviour where AV is cleaning the malware and its coming right back. Its not the magical malware or some super malware, which will come right back after it got cleaned. If its coming back like this, obviously source is on the network. We have network protocols , which do certain things for us on the network. There are not too many protocols that do file access or share access on the network. In windows networks, we have SMB protocol for share and file access. Malware writers do not invent any new protocols, they use these existing protocols, to create files over the network on other machines,to spread infections on the network.

In one scenario, admin was looking for containment method, while he gets his infected machines cleaned using AV. In his scenario,I saw same method of file creation. one of the short term containment idea, that I gave them was to stop inbound SMB traffic, on these infected machines using windows firewall,using netsh command

"netsh advfirewall firewall add rule name ="block445in" protocol=TCP dir=in localport=445 action=block"

SMB may be required for GPO( to get RSOP reports) ,so you may want to revert this after you get back to normal ,but you can stop the spread using this idea.

I had another admin, who wanted to disable the NIC when their AV detects a malware(sounds paranoid, I know) , technically you can do that but it has challenges :)

Technique is simple , I have written a blog post sometime back to do few things based on event id : http://blogs.technet.com/b/sooraj-sec/archive/2013/05/03/generating-netstat-output-when-a-specific-event-occurs-in-the-eventlog-using-powershell.aspx

Get the VBS file as below

Step1 :Copy the contents of the script given in above post shown below in a notepad and save it as EvtMon.vbs and put this in a folder lets call it yourfolder e.g. in c:\yourfolder location

'======================================================================
' Print out the help when something is not typed in correctly or when
' nothing at all is typed in.

Public Sub PrintHelp
    Wscript.Echo "Usage:"
    Wscript.Echo "  EvtMon EventNumber [LogFileDisplayName]"
    Wscript.Echo "    LogFile is optional.  If used, the eventlog name"
    Wscript.Echo "    file ie, application, system, security, etc..."
End Sub

' Get the arguments.  Check for event nubmer and log file as arugments
Set objArgs = WScript.Arguments

' See how many arguments we have and colect them.
if objArgs.Count < 1 OR objArgs.Count > 2 Then
    PrintHelp
ElseIf objArgs.Count > 1 Then
    EventNumber = objArgs(0)
    LogFile = objArgs(1)
Else
    EventNumber = objArgs(0)
    LogFile = ""
End If

If EventNumber <> "" Then

    strComputer = "."

    ' Attatch to the WMI Service
    Set objWMIService = GetObject("winmgmts:{(Security)}\\" & _
            strComputer & "\root\cimv2")

    ' if the LogFile is populated add this to our query.  Create a
    ' Event Log monitoring object and send it a query.
    If LogFile = "" Then
        Set colMonitoredEvents = objWMIService.ExecNotificationQuery _   
            ("Select * from __InstanceCreationEvent Where " _
                & "TargetInstance ISA 'Win32_NTLogEvent' " _
                    & "and TargetInstance.EventCode = '" _
                    & EventNumber & "'")
    Else
        Set colMonitoredEvents = objWMIService.ExecNotificationQuery _   
            ("Select * from __InstanceCreationEvent Where " _
                & "TargetInstance ISA 'Win32_NTLogEvent' " _
                    & "and TargetInstance.EventCode = '" _
                    & EventNumber _
                    & "' and TargetInstance.LogFile = '" _
                    & LogFile & "'")
    End If

    ' Create an object which returns when the next event occurs.
    Set objLatestEvent = colMonitoredEvents.NextEvent
   
    ' Print some info based on the event log we encountered.
    Wscript.Echo objLatestEvent.TargetInstance.User
    Wscript.Echo objLatestEvent.TargetInstance.TimeWritten
    Wscript.Echo objLatestEvent.TargetInstance.Message
    WScript.Echo objLatestEvent.TargetInstance.Logfile
    Wscript.Echo
End If

Step2. Use one of the batch files given below, each has different impact.

Following batch file can block in bound and outbound SMB traffic along with above script, you need to give the event id that your AV generates when it detects malware, please see the link I gave above to check the command.

======= you can copy it as 445-instop.bat from below=======

@echo off

cscript //NoLogo EvtMon.vbs %2 %3

powershell.exe -command "&  netsh advfirewall firewall add rule name ="block445in" protocol=TCP dir=in localport=445 action=block

powershell.exe -command "&  netsh advfirewall firewall add rule name ="block445out" protocol=TCP dir=out remoteport=445 action=block

ping -n 1 4.3.2.1

goto :EOF

=====================================================

Following batch file along with the vbs script in my blog post can be used to disable NIC for a particular eventid(AV generates for detection).

challenge with following is, you need to know the name of the NIC to disable, so its practically its not a feasible option 

========you can copy as NIC-disable.bat from below==========

@echo off

cscript //NoLogo EvtMon.vbs %2 %3

powershell.exe -command "&  netsh interface set interface "Wi-Fi" admin=disable

ping -n 1 4.3.2.1

goto :EOF

===================================================================================

This paranoid approach , to be honest, in my opinion is not very amazing, even with windows firewall and blocking ports, based on event id for malware detection because it will work for malwares, for which your AV has signatures, not for new variants. But if you want it done anyways, you can technically :).

For readers, I would welcome more ways of containment(ISC2's book on CISSP has given few but if you know things other then that ), if you are reading it you can add your methods in the comments.

Background

As an example, I will discuss a scenario. So one of the organisations had an incident, they thought was a security incident, as suddenly they started seeing pop-ups, authentication prompts on client machines, with different messages. Looking at this weird behaviour, their team that was working on it, thought its a malware attack. That team and their executive management were in extremely panic state. I was engaged on it in later stages of our engagements. After understanding the scenario and problems they were encountering. My first question to them was, what is the Business Impact of this incident? they took some time to answer that question, as probably they did not think it was necessary to think about the business impact of that incident or event.  Answer although came little late, was about possibility of unauthorized disclosure.

Investigations

Based on that response, I checked "netstat -ano" on one of the problem machines, a client machine. There were not more then few established connections, out of them few were SMB/CIFS connections going to their known file servers, remaining connections were also going to known local machines, which were verified individually. Tcpview tool from sysinternal also provided details of the processes who had initiated those connections , all those processes were also known processes. Previously our engineers had also checked (ASEPs)auto runs, using autorun tool from sysinternal ,nothing suspicious was seen in that. Same was true with process explorer tool when it was run on the same machine earlier, no suspicious processes. Then, I took network captures using netmon 3.4 tool, to check the SMB/CIFS traffic and verify if files are getting created on destination machines or on the local machine, nothing of that sort was seen in traces either.

So from observations so far, there was no evidence of malicious activity on the network from that machine and even locally. They informed us that certain files were getting created after some time, in a particular folder  and wanted answer on that occurrence. I suggested them to enable auditing on that folder and we  will be able to find out which process of an application is creating those files in that folder. While  our AD team helped them in setting up auditing on that problem folder. We ran our famous tool that collects all ,volatile and non-volatile information, along with USN journal info using which we can track activities on files. Data analysis of that, also pointed to one thing, "No Evidence of Malicious activity".

Then answer for creation of files in a particular folder, came from auditing I got implemented by our AD team. It pointed to a misbehaving application creating those files and other weird activities, that were occurring on the machines. It was hard to believe for some ,who thought it was all malicious and it was a security Incident, but in reality it was not. But when we look back from where it started and where it ended. There so many lessons in it to be learned.

Lessons to be learned, point to serious business need of a Security Incident Management Program

First impression of this episode, CHAOS and PANIC. This caused guys who were working on it ,from that organisation side and their Executive team to go in extreme panic and stressful state whole day. This could have been avoided completely, if they had a Security Incident Management Program in place. You ask me how? There are open standards( ISC2 ), SANS and so many other institutions that talk about security Incident management. At Microsoft,  we also have an offering on this ,its called POP SIM(Security Incident Management). I however would talk just about the standard and if our customers get interested in POP SIM, we can have separate discussions with them.

In general, this program allows an organisation to create a framework and policies about how to deal with an security incident . Following diagram explains the usual flow of it, so when incident comes, usually reported by IDS,SEIM,firewall logs, suspicious activity seen by users,admins etc. Its triaged to check, if its truly a security incident, if its false positive then its handled like an usual event(non-security incident).

After initial determination, once its determined that its not a false positive and indeed is a security Incident.  It is categorized into predefined incident categories, based on business impact of the incident and as per previously determined security incident management policies. Then as per the policies, its occurrence is communicated to right teams and right people for further handling.

Note: Diagram, here I have drawn based on inputs from various books on this subject mainly ISC2 and related books and here it is purely for informational and educational purpose.

Incident response is mix of steps that happen in series and steps that happen in parallel. At this stage two things happen in parallel, they are :

1. Containment 

2. Investigations with initial RCA to reduce the impact.

 Objective is(apart from reducing the impact), to stop the spread of incident any further and also to contain the access of attacker, in case its a directed attack without giving hint to them, as this can go horribly wrong ,if not handled delicately and with caution. This is done ,if we want to track the attackers and prosecute them.

Then, in next stage of detailed analysis, more data is collected using various tools and deeper root cause analysis is done to find out who did it, how they did it, how they came in, in case its a directed attack.

But if its just a malware, then how it came, what AV we are using, is it updated to latest, is it able to detect it. If not have we contacted AV vendor for signatures yet? What's the nature of malware, how it spreads, containment is super important for spread mitigation.

This is a circular process, as based on new evidence, many steps are revisited again.

After RCA and finding root cause of the incident and reducing the impact and containment, Recovery process starts, to bring back affected systems and networks to production.Its also a tricky thing, its a risk based business decision, whether to rebuild a compromised system or just a repair or clean or removal by AV is good enough,decision that an organisation has to take based on their own scenario, how much time ,money effort they are willing to put in this. Recovery it self is a huge topic and would need separate dedicated discussion.

Then incident needs to be closed ,it becomes more important when there are multiple incidents happening, it will be difficult to track progress of them.So based on criteria established in policies ,incident shall be closed after it meets that criteria.

Reporting of incident with post-mortem of how,when what,where happened, to engaged and concerned people. From here lessons learnt are used to mend the established security incident policies, to ensure mistakes are not repeated and organisation matures its process further based on this input.

Replaying the Example Incident

Lets assume that, there is another organisation, who also have security incident management program in place, when this organisation runs into this same issue, they would perform triaging, with an experienced skilled triaging team, in this step itself they would have filtered this incident as a false positive and would have handled it as a non security incident or event.

In case, if they were paranoid and to be on safer side decided to consider it as a security incident, then in the next stage of categorizing the incident based on the business Impact, they would have effectively categorized it as Severity C. This however requires experienced and skilled team members, this is where, if they don't have their own they can engage Microsoft or any other trusted third party to help them.

So this organisation following their security incident management program, would have effectively managed the incident without panic ,chaos and resulting extreme stress for people engaged on the incident.

Business and Money

You can clearly imagine, if you don't have this program, if 10 incidents happen you will manage them with same chaos, panic and extreme stress. End result, you can imagine that too, it costs lot of money to engage resources on each incident. If you spend  USD 10,000 on one Incident at minimum (a very low figure in reality), its easy math to know how much you will spend on 10.

But if you do have a Security Incident Management program, Then probably you may spend USD 10,000 on high impact incident and probably USD 500 on an incident that appeared  initially as a security incident but after triaging, it was marked as a false positive and sent out to be handled as a non security incident to IT team instead of security team.

It would also save so much of time for people involved which can be utilized in better ways. Obviously, low stress levels and happier lives.

http://blogs.msdn.com/b/azuresecurity/archive/2015/08/14/azure-forensics-for-the-security-responder-how-i-learned-to-stop-worrying-and-love-the-cloud.aspx

http://www.oxhow.com/reset-windows-7-password-without-password-reset-disk/

I looked at it and tested it in lab and was able to change the password as explained in it. Then I also came across the ways to mitigate this for example.

If we execute below command in elevated command prompt(admin command prompt), this will disable launch of repair that is done in the article given

bcdedit /set {default} bootstatuspolicy ignoreallfailures

There are other ways as well. But that’s not that important, what’s important is(as per me and few others as well) ,that’s what I’m going to discuss here.

If you already are not aware of “Ten immutable laws of security” refer http://blogs.technet.com/b/rhalbheer/archive/2011/06/16/ten-immutable-laws-of-security-version-2-0.aspx

List is here, so if we look at it, this is hitting law#3

Law #1: If a bad guy can persuade you to run his program on your computer, it's not solely your computer anymore.
Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore.
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
Law #4: If you allow a bad guy to run active content in your website, it's not your website any more.
Law #5: Weak passwords trump strong security.
Law #6: A computer is only as secure as the administrator is trustworthy.
Law #7: Encrypted data is only as secure as its decryption key.
Law #8: An out-of-date antimalware scanner is only marginally better than no scanner at all.
Law #9: Absolute anonymity isn't practically achievable, online or offline.
Law #10: Technology is not a panacea.

i.e. Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. So if you indeed are hitting this law and still think operating system should have a mitigation for it by default, then a rethink on it is required.

I was thinking about a scenario, when this can happen to non-corporate machine e.g. regular user and when can this happen to a corporate user’s machines, which are either desktops or laptops.

For non-corporate regular user, this can happen if she loses her laptop. Same is true for a corporate user i.e. if she loses her laptop, so what’s the best defense or mitigation regarding this if you are hitting law # 3 .

 I would feel safe as both type of user, if my data is not accessible to bad guy. That’s only possible with encryption i.e. if user’s laptop’s drive is encrypted.  Microsoft’s latest operating systems have a feature called Bitlocker which is a strong, in fact best defense in such scenario. If bad guy does not have the bitlocker key, he can’t even get to the starting point that’s mention in the blog link of hack. He cannot access data in the drive, its ENCRYPTED J. So although user would still lose the data ,if she hits the law #3 and her machine as well but data will not be compromised or disclosed, nobody can see it.

For desktops in enterprise, its little difficult to imagine hitting law # 3 but here again Bitlocker is a super defense, bad guy can’t go any farther then the bitlocker key screen J.

In information security, confidentiality of data is maintained by ensuring its encrypted at rest and also when it is at move using protocols like SSL , Ipsec. So Encryption is the way forward(its already there, some are using it some are not).

Following are few links about how bitlocker can be enabled, these are few, will add more as and when I ll find more

http://windows.microsoft.com/en-in/windows-8/bitlocker-drive-encryption, windows 8

https://technet.microsoft.com/en-us/library/dd835565(v=ws.10).aspx windows 7

https://technet.microsoft.com/en-us/library/dd875547(v=ws.10).aspx

http://windows.microsoft.com/en-IN/windows7/what-group-policy-settings-are-used-with-bitlocker

http://windowsitpro.com/security/deploy-bitlocker-your-organization-right-way

This intro is purely for people who are not from information security and have not heard of this attack, although that's rare. So straight from the Microsoft  pass the hash whitepapers.

"

What is the PtH attack? The Pass-the-Hash (PtH) attack and other credential theft and reuse types of attack use an iterative two stage process. First, an attacker must obtains local administrative access on at least one computer.. Second, the attacker attempts to increase access to other computers on the network by:

1. Stealing one or more authentication credentials (user name and password or password hash belonging to other accounts) from the compromised computer.

2. Reusing the stolen credentials to access other computer systems and services. This sequence is often repeated multiple times during an actual attack to progressively increase the level of access that an attacker has to an environment.

"

Why we are talking about hashes, once again from white paper

"

A password hash is a direct one-way mathematical derivation of the password that changes only when the user’s password changes. Depending on the authentication mechanism, either a password hash or a plaintext password can be presented as an authenticator to serve as proof of the user’s identity to the operating system

"

Some Back Ground Now

While preparing for a security certification some time back, I studied about cryptography. I loved the interesting details of one way hashes, the way they are created  and that they are one way and cant be reversed.Although there is something called birthday attack, that can happen to them, which is in fact about a chance that two numbers can have same hash. Initially I thought its something really strong and unbreakable. My friend Junaid who was my team mate, this is when we were not part of the IR(incident Response ) team. Junaid told me he had heard that these hashes can be broken and they get stolen through a attack called pass the hash.  I could not believe when he said hashes were breakable and there was something called pass the hash attack. After hearing about it, I really got curious and read about it. Found huge material about it, our internal as well as on the internet explaining it.

Why I am writing about it ? What's the point ?

Usually, if  we are talking about it, in an incident response scenario, this means couple of things, this is a targeted attack. A targeted attack has few stages and this stage is, in which  the attacker is already inside the network and trying to get passwords of high privilege or administrator's passwords, to get control over the most important assets of an organisation they are attacking. This attack has huge history and there is so much written about it, but still not many have heard of it. The pass the hash whitepapers from Microsoft is really detailed document. It explains what is this attack. what are the Risk factors and then provides detailed mitigation steps. Irony is that when document is really detailed and structured and little on lengthier side, Some People do not actually read it. But if We are really serious about mitigating it, in our network environment then we should read it thoroughly.

A myth or wrong perception that "This is only related to windows environment, Linux based machines don't have this problem"

I had a discussion around this myth with someone .I  provided detailed answers to them, explaining that its lateral issue of a luxury requirement which has become necessity called "single sign on" and not a Bug, that any OS vendor shall fix it. Its a universal problem and not just windows or Linux problem.This problem is operating system independent i.e. pass the hash attacks happen on all operating systems .Since most organisations are on windows domain, more you hear about it in relation to windows domain. There is another fact, this happens only when best security practices are not followed as given in whitepaper. 

So what is single sign on?

 I once asked this question to a very senior colleague in our Edge team during our WAP training sessions(a completely different topic).  Answer I got was, depends on scenario and then explanation(keeping ADFS in picture) of those scenarios was quite long.

But I will make it easy and according to our context. I will explain it the way I explained to one of network admins, who were discussing this issue with me. Explanation, which is very simple is, if a user logs on to his machine, in the domain network, then tries to access  printer on the network or files on fileserver at that moment, if we remove single sign on from the picture, every time this user tries to access these and other such network resources, she will get authentication prompt, to enter her credentials to access that resource. These days most of such resources are on the network and not local to machine. So it will make a user's life really difficult, if she has to enter the credentials every time she accesses a resource on the network.

Process or Service that helps in single sign on

In windows operating system, there is a service or process called LSASS, which stores the logged on user's password hash in its memory, it uses it when logged on user tries to access an resource on the network , user is asked for credentials. LSASS provides this password hash behind the scenes and user is not even aware of this. So this single sign on happens without the users knowledge.He keeps accessing network resources without getting prompted for authentication. Sweet!!

That's what attackers know as well.They use various techniques discussed in the pass the hash attack whitepaper, to get a regular(non power/non admin) user's credentials.One of the technique is called phishing, which is used  for credential theft . So  by using such a technique attacker gets the credentials of a user and then elevate his privilege. Then they install tools like mimikatz or WCE , then get hold of logged on users password hashes as well as Kerberos tickets . Then make lateral network movement with high privileged account credentials, to get control over the more important assets of the organisation. Then they kind of own the precious resources on the network.

A question, Can we do something with LSASS to not remember or cleanup the logged on users credentials after log off?

Answer to that is, yes we can, Following article

http://blogs.technet.com/b/srd/archive/2014/06/05/an-overview-of-kb2871997.aspx

in following section explains it

LSA Credential Cleanup & Other Changes

a. Removal of credentials after logoff

As outlined in Microsoft’s Pass-the-hash whitepaper, Windows caches the credentials of a user in the LSASS process whenever the user logs in. This includes the user’s clear-text password, the users NT/LM password hash, and the users Kerberos TGT/Session key. When the user logs off, the credentials should be cleared out of memory. Prior to this update, this was not always the case. This issue preventing credentials from being cleared is now fixed, credentials will always be cleared from memory after a user logs off.

As we know its like a Cat and mouse game between attackers and security professionals defending against them, Microsoft has added another feature called LSASS protection explained in following article  

https://technet.microsoft.com/en-in/library/dn408187.aspx

 Relevant excerpts from the article are below

What is LSASS protection?

This topic for the IT professional explains how to configure additional protection for the Local Security Authority (LSA) process to prevent code injection that could compromise credentials.

The LSA, which includes the Local Security Authority Server Service (LSASS) process, validates users for local and remote sign-ins and enforces local security policies. The Windows 8.1 operating system provides additional protection for the LSA to prevent reading memory and code injection by non-protected processes. This provides added security for the credentials that the LSA stores and manages. The protected process setting for LSA can be configured in Windows 8.1, but it cannot be configured in Windows RT 8.1. When this setting is used in conjunction with Secure Boot, additional protection is achieved because disabling the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa registry key has no effect.

How you can enable it ?

To enable LSA protection on a single computer

1.            Open the Registry Editor (RegEdit.exe), and navigate to the registry key that is located at: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.

2.            Set the value of the registry key to: "RunAsPPL"=dword:00000001.

3.            Restart the computer.

To enable LSA protection using Group Policy

•          Open the Group Policy Management Console (GPMC).
•          Create a new GPO that is linked at the domain level or that is linked to the organizational unit that contains your computer accounts. Or you can select a GPO that is already deployed.
•          Right-click the GPO, and then click Edit to open the Group Policy Management Editor.
•          Expand Computer Configuration, expand Preferences, and then expand Windows Settings.
•          Right-click Registry, point to New, and then click Registry Item. The New Registry Properties dialog box appears.
•          In the Hive list, click HKEY_LOCAL_MACHINE.
•          In the Key Path list, browse to SYSTEM\CurrentControlSet\Control\Lsa.
•          In the Value name box, type RunAsPPL.
•          In the Value type box, click the REG_DWORD.
•          In the Value data box, type 00000001.
•          Click OK.

As i said earlier, white paper is still the key. Why ? lets assume even after following above steps , if an attacker using phishing attack is able to get a user’s credentials. Then attacker is able to get to a user’s machine on the domain ,then elevates his privileges, if organisation is not following security best practices explained in pass the hash white paper. Attacker then can install tools like mimikatz or WCE(windows credentials editor), then using them monitor and possibly get and save hashes of logged on user.

So it becomes really important to follow the mitigations mentioned in pass the hash whitepaper to be secure.

Disclaimer : These are purely My thoughts and this document is still work in progress, as I would keep adding either parts to series or adding to this document. There are important discussions about Local admin account and common password usage for it and making life easy for an attacker, to make lateral movement and Irony of admins who need such a thing to manage their things easily . That there is an awesome solution to that problem called SLAM solution, I will write about it later.

So scenario was that the  web servers  in a network were under DDOS attack,Admin's of the network and web servers found about the attack from their monitoring system(IPS- Intrusion  prevention system) events that detected the attack but could not prevent it.

I had a detailed discussion with  admin about the location of the web servers, most of them were in DMZ(De militarized Zone) behind a firewall. Most of the Web servers were behind the IPS device as well. Still they were under attack.  Difference between the IPS(Intrusion Prevention Device) and IDS(Intrusion Detection device) is that IPS can take measures to prevent the attack , where as IDS will detect and inform the admins about it, as monitoring mechanism. I thought it was interesting to know that Web servers were behind IPS and were still experiencing DDOS attack.

But explanation is pretty straight forward . IPS devices mostly are either signature based or anomaly(statistical) based or both depending on the manufacturer providing these features.  So if IPS devices is signature based, it wont be effective in DDOS attack scenario. On the other hand ,IPS devices that have anomaly based protection, can defend against DDOS attacks.

So the Admin in this case was not sure about the  type of IPS they had in place, so they wanted help regarding this on the web servers. Web servers were running on windows server 2008 and above. Guided them  that Windows vista/7/2008 and above have built-in protection mechanism for such attacks as explained in this article. There is another nice article that explains a way to find out that attack protection triggers when such a attack is detected ,there is netsh trace command given in the article that will allow you to see that.

For a quick check on their web server I took a netstat -ano output and found as below and compared the total number of TCP connections and the number of syn_received and found the count of these syn_received to be less then hundred and we know that maximum ports available on the server are 65535, so although they were seeing this attack in action but it has not done what it was supposed to do, i.e. denial of service, i.e. making the web server not able to serve on this port yet

---------------------------------------------------------------------------------------------

.   TCP    mydummyIP:80       attackerdummyIP:port      SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP: port      SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP: port     SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP:port    SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP:port     SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP2: port     SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP2: port     SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP3: port     SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP 3port     SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP4: port     SYN_RECEIVED    PID

.   TCP    mydummyIP:80       attackerdummyIP4: port     SYN_RECEIVED    PID

.  TCP    mydummyIP:80       attackerdummyIP5: port     SYN_RECEIVED    PID

---------------------------------------------------------------------------------------------

Using the netsh command " netsh trace start capture=yes provider=Microsoft-Windows-TCPIP level=0x05 tracefile=TCPIP.etl" I took tracing and then looked through the trace and I could see the attack protection by the OS in place, we could see that web server after receiving such syn packets after some time starts dropping them. But you will also see that for some new request it does respond, which is obvious as it has to judge if its a good user or malicious. Apart from that we ran our internal tools to ensure there were no malware and malicious activity other then the DDOS traffic coming from external sources, which are usually botnets.

Suggestions

Running antimalware(with current and updated signatures) on servers to make sure there is no malware on it. Usually its better and efficient to handle such attacks at the network ,using statistical Anomaly based IPS/IDS devices and firewalls  rather then on the servers. In addition to that at network level the scaling up of the network bandwidth would be required to deal with such a situation.

There is another alternative of transferring the Risk of such threats to service providers like Azure and let them deploy these services for you, who have much bigger network bandwidth/pipe and security mechanism in place to deal with such scenarios. This Windows azure network security whitepaper explains it. Azure CDN is another option as well.

Some third party interesting reads

http://www.lifehacker.com.au/2013/04/top-ten-lesser-known-facts-about-windows-azure-security/

http://www.gregthatcher.com/Azure/Ch10_StopDenialOfServiceOnAzure.aspx

Following is Quote from the Top IR(Incident Response) Expert on this topic,the one and only Neil Carpenter

It's been my opinion that moving to Azure/AWS/Rackspace/etc is the _best_ possible solution. It doesn't matter how much traffic you drop -- a sufficiently motivated attacker can saturate bandwidth on your Internet connection. When they do this, it's not only going to degrade the performance of your website...it's going to degrade the performance of everything that shares that pipe.

You're much better off moving all of the risk and the traffic out to a provider who has the resources to ride out an attack.

If you have a lot of static content, you may also want to consider a CDN like Akamai.

If you are smart then you will keep your machines protected by super patching, leaving no vulnerable software and operating system .Apart from that, have Backups for all your important stuff.

MMPC(Microsoft Malware Protection Center) has recently published a post on its blog , you can read that here. The most important points discussed, in this is how ransom ware (Win32/Crowti and its family) spreads, which is majorly via spam emails containing attachments, luring users to open them. The other way is through exploit kits, which provide exploits, to exploit the java or flash vulnerabilities on a user’s system i.e. if these software are unpatched and are hence vulnerable.

 This post, is an example, where an exploit kit manages to exploit a vulnerability on the system. In this scenario, it was a client machine i.e. machine with a client operating system, on a network that got infected. We were trying to find the way infection happened, so we collected data from the infected machines and started looking at it.

Observations from data

I’m putting down sequential activity below, sequenced in terms of time.

Vulnerable software list as pulled down by data collection tool, partially shown below, on the infected machines did not have Java updated and hence left machines vulnerable. By comparing the installed versions and latest versions of java software, on these infected machines, we could understand clearly the big hole in them, as installed versions were way behind the latest versions. That’s what exploits from the exploit kits keep looking and if found, its bull’s eye for them and they nail it.

Let’s now connect the dots together in this scenario. So we could see that suspect plugin was getting launched (as we can see from pre-fetch files in above table of activity), about prefetch folder and files please refer http://windows.microsoft.com/en-in/windows-vista/what-is-the-prefetch-folder.

Every time, it was getting launched, it was crashing IE for some reason. Then it was trying to launch Volume shadow copy, to find backups and also encrypt them. Then it started launching Java files, obviously exploit, found out that java software were unpatched and exploited them. So what happened is, that it put the java jar files on the machine and unzipped it in the memory not on hard drive, hence went undetected from the antivirus on the system. Then started its operation and next thing we see is, it starts encrypting the files on the system. Checkmate, game over.

 So Ideal thing to do here, as prevention is to make sure, your machines are patched.

 I have also seen third party websites suggesting restriction of executable in appdata folder on the machine e.g.

 On following path

 Path: %AppData%\*.exe

 i.e. Create rules to make sure executables cannot run on this location i.e. subfolder of %AppData%.

 But we don’t either suggest or recommend it, as there could be good applications that may need to run from this location, however Applocker can be used to white list the legal applications to run on the machine.