p59342861
/
monkey
forked from p15670423/monkey
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #1278 from guardicore/ransomware-readme-docs 

Ransomware documentation modifications for README.txt
This commit is contained in:
Mike Salvatore 2021-06-30 06:49:40 -04:00 committed by GitHub
parent 6301ec9d14 0d0d268a64
commit 0f6a712c4c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 49 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
docs/content/reference/ransomware.md
View File

@ -6,41 +6,75 @@ pre: '<i class="fas fa-lock"></i> '
weight: 10 weight: 10
--- ---
The Infection Monkey has the capability of simulating a ransomware attack on your network. The Infection Monkey is capable of simulating a ransomware attack on your
All actions performed by the encryption routine are designed to be safe for production network using a set of behaviors.
environments.
#### Encrypting user-specified files
All actions performed by the encryption routine are designed to be safe for
production environments.
To ensure minimum interference and easy recoverability, the ransomware
simulation will encrypt files only if the user specifies a directory that
contains files that are safe to encrypt. If no directory is specified, no
files will be encrypted.
#### Leaving a README.txt file
Many ransomware packages leave a README.txt file on the victim machine with an
explanation of what has occurred and instructions for paying the attacker.
Infection Monkey can also leave a README.txt file in the target directory on
the victim machine in order to replicate this behavior. This can be enabled or
disabled by checking the box on the configuration screen. Note that if no
target directory is specified for encryption, Infection Monkey will not leave a
README.txt file.
<!-- add screenshot highlighting readme option -->
The README.txt file informs the user that a ransomware simulation has taken
place and that they should contact their administrator. The contents of the
file can be found
[here](https://github.com/guardicore/monkey/tree/develop/monkey/infection_monkey/ransomware/ransomware_readme.txt).
To ensure minimum interference and easy recoverability, the ransomware simulation will encrypt
files only if the user specifies a directory that contains files that are safe to encrypt.
If no directory is specified, no files will be encrypted.
<!-- add config screenshot here --> <!-- add config screenshot here -->
## How are the files encrypted? ## How are the files encrypted?
Files are "encrypted" in place with a simple bit flip. Encrypted files are renamed to have Files are "encrypted" in place with a simple bit flip. Encrypted files are
`.m0nk3y` appended to their names. renamed to have `.m0nk3y` appended to their names.
This is a safe way to simulate encryption since it is easy to "decrypt" your files. You can simply perform a bit flip on the files again and rename them to remove the appended `.m0nk3y` extension. This is a safe way to simulate encryption since it is easy to "decrypt" your
files. You can simply perform a bit flip on the files again and rename them to
remove the appended `.m0nk3y` extension.
This is sufficient to mock a ransomware attack on your network as the data in your files has been manipulated (temporarily leaving them unusuable) and are renamed with a different extension, similar to the way that many ransomwares act. As this is a simulation, your security solutions should be triggered to notify and prevent these changes from taking place. This is sufficient to mock a ransomware attack on your network as the data in
your files has been manipulated (temporarily leaving them unusuable) and are
renamed with a different extension, similar to the way that many ransomwares
act. As this is a simulation, your security solutions should be triggered to
notify and prevent these changes from taking place.
## Which files are encrypted? ## Which files are encrypted?
All regular files with [valid extensions](#file-extensions-targeted-for-encryption) in the configured directory are attempted to be encrypted during the simulation. All regular files with [valid
extensions](#file-extensions-targeted-for-encryption) in the configured
directory are attempted to be encrypted during the simulation.
The simulation is not recursive, i.e. it will not touch any files in sub-directories of the configured directory. Symlinks and shortcuts are ignored. The simulation is not recursive, i.e. it will not touch any files in
sub-directories of the configured directory. Symlinks and shortcuts are
ignored.
These precautions are taken to prevent the monkey from going rogue and accidentally encrypting files that you didn't intend to encrypt. These precautions are taken to prevent the monkey from going rogue and
accidentally encrypting files that you didn't intend to encrypt.
## File extensions targeted for encryption ## File extensions targeted for encryption
Encryption attempts are only performed on regular files with the following extensions. Encryption attempts are only performed on regular files with the following
extensions.
This list is based on the [analysis of the Goldeneye ransomware by BitDefender](https://labs.bitdefender.com/2017/07/a-technical-look-into-the-goldeneye-ransomware-attack/). This list is based on the [analysis of the Goldeneye ransomware by
BitDefender](https://labs.bitdefender.com/2017/07/a-technical-look-into-the-goldeneye-ransomware-attack/).
- .3ds - .3ds
- .7z - .7z