Detectar ransomware mediante Threat Intelligence

How to correlate Qumulo events with Threat Intelligence data

Now, as we feed the Threat Intelligence into our Azure Sentinel workspace, we can correlate the data and check all Qumulo filesystem activity. For example, we could look for connections to any known bad IP address from our different feeds with the following query:

let timerange = 15min;
let MalIpList = (ThreatIntelligenceIndicator | where Description contains  "mal_ip" | project NetworkIP);
QumuloAuditEvents
| where ClientIP in (MalIpList)

This query will result in a list of all activities that any Qumulo node had with one of the bad known addresses from the intelligence feeds.

This is a good example where we’d need to start automation. If the above query would show any positive results, we’d like to automatically create an alert, an incident and potentially fire up an automated response. In this case the assigned data security analyst would investigate if this IP address did ever show up earlier in our environment and take action if it did.

In any case, we would update the rules in our firewall(s) so that this address gets totally blocked out. This is a good example of preventive action. Even though this IP address had (hopefully) never contacted our network, we’d block it in advance because we know (from the TI feed) it’s related to malware activities.

How to use Machine Learning to detect ransomware and suspicious anomalies

Azure Sentinel has some Analytic Rules that use Machine Learning (ML) to uncover anomalies or detect ransomware in your data storage environment. Microsoft has introduced a new rule type, called Anomaly, for this purpose. You don’t need to worry about managing the ML run-time environment for suspicious anomalies, because Azure Sentinel takes care of everything behind the scenes.

You can find these rules in Azure Sentinel in the Analytics tab, and it seems Microsoft is adding more over time. These rules use ML to train a model for a couple of days to set the baseline for usual conditions. This could be network traffic patterns, login patterns in Azure Active Directory (Azure AD), firewall alarms, web requests, and more. The parameters of the pre-defined rules can be modified to balance the noise level to a meaningful level.

The algorithms in the pre-defined rules are not trained for Qumulo events. However, using them with events from other sources—such as Azure AD or firewalls—improves ransomware detection, and reduces investigation and threat hunting time.

Following are the 3 main use cases for using machine learning to detect ransomware.

1. Additional signals to improve ransomware detection

Data security analysts can use anomalies to detect new threats and make existing detections more effective. A single anomaly is not a strong signal of malicious behavior, but when combined with several anomalies that occur at different points on the cyber kill chain, their cumulative effect is much stronger. Security analysts can enhance existing detections as well by making the unusual behavior identified by anomalies a condition for alerts to be fired.

2. Evidence during investigations

Data security analysts also can use anomalies during investigations to help confirm a breach, find new paths for investigating it, and assess its potential impact. For example, when investigating an incident that involves a user and an IP address, a security analyst can query the user and the IP address in the "Anomalies" table to find out other anomalous activities performed by that user and that happened on that IP address. These data help security analysts reduce the time spent on investigations.

3. The start of proactive threat hunts

Threat hunters can use anomalies as context to help determine whether their queries have detected suspicious behavior. When the behavior is suspicious, the anomalies also point toward potential paths for further hunting. These clues provided by anomalies reduce both the time to detect a threat and its chance to cause harm.

We just reviewed how to run queries to detect ransomware and other suspicious activities. Next, we'll show you how to automate these ransomware detection queries in Azure Sentinel.

Qumulo Recover Q: Disaster recovery solution to help guard against ransomware

Qumulo Audit logs can be used via syslog with any SIEM solution for detection.

We also offer Qumulo Recover Q—a flexible cloud based disaster recovery solution that fits into any existing business continuity strategy. Active protection features help ensure data safety and integrity, while built-in snapshot and cloud replication features add layers of defense against real-world threats that could compromise your data or operations.

Using Recover Q in the cloud can help optimize your company’s spending for business continuity by reducing on-premises costs in favor of an on demand, cloud-native service.

Further Reading

Have a look at our two white papers to learn more about ransomware detection with Qumulo audit data and SIEM platforms, and the built-in data services (Qumulo Protect and Qumulo Secure) that come standard with your Qumulo software subscription:

• Security Architecture and Best Practices to Counter Malware
• Threat Hunting with Qumulo Audit and Azure Sentinel

Like what you see?

Contact us to book a demo or arrange a meeting. You can even test drive a fully functional Qumulo environment right from your browser:

Test drive Qumulo for free

Explore a fully functional Qumulo environment, right in your browser.

Try Demo