Signature based
Last updated
Last updated
A malware signature is a footprint or pattern observable in a malicious attack. These patterns include file sizes, imported functions, file hashes, printable strings, byte offsets, and other indicators of compromise (IoCs). Signature-based detection operates by comparing the activity of the provided sample with the database of recognized patterns.
Here's the step-by-step process for signature-based ransomware detection:
A new type of ransomware is discovered.
The ransomware's footprint is added to a database.
The antivirus product is updated to include the new database.
The antivirus product is then able to detect the ransomware during scans by searching for its footprint.
There are several advantages of using signature-based detection to identify and respond to threats — it offers several benefits over basic file hash matching. One advantage is that it enables analysts to target entire malware families rather than just a single variant. This is because signatures often match commonalities among variants.
Another advantage is that signatures are extremely versatile and can be used to detect various types of file-based malware. Signatures can be written to include or exclude specific file types. This means that signature-based detection methods can be used to potentially scan and match a signature across almost any file type. Furthermore, simple signature formats such as YARA are useful to security professionals across the globe. YARA offers a standardized text-based format for signature-based detection rules to be written and tested, meaning that rules can be shared across the cybersecurity community in threat intelligence feeds.
A few days ago, you received a ticket stating that some of the older testing hardware in Commensurate Technology (ComTech) have been infected with ransomware. You prepare yourself for the worst, but after looking into the hardware you discover that it is one of the older versions of WannaCry to be specific. Since the testing hardware is not used very often and no sensitive data was stored on them, you simply erase all and start with the fresh copy of Windows 10. Only this time, you decide to deploy the Elastic Security Endpoint Detection and Response (EDR) solution on all of the testing hardware.
After deploying the EDR solution, you should now test that the malware prevention and alerts work. To do that, you will need a real ransomware sample. You decide to speak with a colleague who used one of the testing laptops before the ransomware attack.
The investigation shows that the ransomware was dropped by a Trojan, which was delivered via a malicious macro from a phishing email to one of the developers that used the hardware. Fortunately, you have been able to successfully extract samples of both the ransomware and the dropper from one of the infected machines.
Now it's time to put Elastic's signature-based detection capabilities to the test.
Extract the malware to the dektop
Password: infected
After a short wile the elastic agent did detect the malware and removed it:
Go trough the security details to answer the questions.
What is the severity score for this alert?
What is the MD5 file hash value of the ransomware?
What is the original file name of the ransomware?
What is the file size (in bytes) of the ransomware?
The secerity score is 73
The MD5 hash is 84c82835a5d21bbcf75a61706d8ab549
The original filename is: diskpart.exe
File size is: 3514368 bytes
The main limitation of signature-based detection is that it cannot identify zero-day attacks or new malware with unknown signatures. This is because security solutions will have no corresponding signature stored in the database. For this reason, signature-based ransomware detection will always be a reactive approach to cybersecurity, meaning that it's impossible to get ahead of the attackers when it comes to malware signature.
The second major limitation of signature-based detection is the emergence of fileless malware, that is, malware in which the code is run directly in memory rather than by executing a malicious file.
If you extract the contents of the Emotet.zip file on the desktop, you will notice that, unlike the WannaCry sample, Elastic is unable to detect a malicious signature from the Datei 1609(2).doc file. This is due to the fact that malware authors often change Emotet, making it difficult to detect by signature-based methods. However, if you upload the file to VirusTotal or search for the file using its hash, you can clearly see that it is in fact malicious
Virustotal results:
