Unlocking Ransomware Investigations: Effective Use of Windows Event Logs as Advised by JPCERT/CC
Unpacking JPCERT/CC’s Advice on Utilizing Windows Event Logs for Ransomware Investigations
The Japanese Computer Emergency Response Team Coordination Center (JPCERT/CC), in a move to bolster the efficiency of ransomware investigations, recently recommended the utilization of Windows event logs.
By citing specific entries in these logs, security professionals can potentially mitigate the damage inflicted by human-operated ransomware attacks.
Context
Primarily, JPCERT/CC noted the difficulty in identifying the attack vector during the initial response to a ransomware attack.
This complexity arises from the sophistication of recent human-operated ransomware strains, which, unlike conventional ransomware, focus on specific targets and require manual operation by the attacker.
This shift in approach necessitates the need for more intricate post-infection investigation methods, prompting the turn to event logs.
Event logs—application, security, system, setup, etc.—maintain a record of significant software, hardware, and security-related events on your Windows machine.
Gathering, parsing, and analyzing these can offer a treasure trove of information about the activities that have transpired on a system, facilitating ransomware attack investigation.
Roadmap to Detection
JPCERT/CC has compiled a list of specific entries in Windows event logs that could be indicative of a ransomware infection, providing enterprises with a more direct method to detect attack vectors.
These include the detection of a process creation event (Event ID 4688) that can indicate the execution of a PowerShell command—a common tool used in ransomware attacks.
By detecting these process events, organizations can detect the deployment of ransomware.
While this presents a step forward in battle against cyber threats, it is only one of the several techniques that security professionals can use as part of their overall strategy.
Other robust mechanisms like Endpoint Detection and Response (EDR) solutions can provide a higher level of security.
In Practice: Emotet Case Study
Let’s take an example of the Emotet malware that was recently unearthed.
Upon infiltration, Emotet tends to create a new process with the ‘rundll32.exe’ making an entry in Windows event log (Event ID 4688).
With the insights provided by JPCERT/CC, detecting such entries early can help nip the infection in the bud, to an extent.
Besides process creation events, monitoring file share audit events, SMB session events, and other specific anomalies in event logs can also offer clues in detecting ransomware.
Final Thoughts
While the JPCERT/CC findings provide a valuable resource for the forensic analysis of ransomware-related event logs, it should be remembered that those are general guidelines, and the characteristics of ransomware attacks may vary.
Hence, a robust mix of monitoring tools, updated knowledge of emerging threats and a well-planned incident response strategy remain critical components for an organization’s defense strategy.
