Palo Alto Networks Protections for Petya Ransomware

This post is also available in: 日本語 (Japanese)

What happened:

On June 27, 2017, the Petya ransomware began impacting multiple organizations, including government and critical infrastructure operators. The attack spreads using multiple lateral movement techniques, with similarities to the May 2017 WanaCrypt0r/WannaCry attacks, including one method using the ETERNALBLUE exploit tool to traverse the network via Microsoft Windows SMB protocol. Palo Alto Networks customers were automatically protected from Petya attacks with protections created, delivered and enforced across multiple elements of our Next-Generation Security Platform. You can further watch an on-demand webcast covering threat context and preventions for Petya here.

How the attack works:

While the initial infection vector is unclear, Petya attempts to spread to other hosts using multiple lateral movement techniques, including exploiting an SMB vulnerability (CVE-2017-0144) on Microsoft Windows systems reportedly using the ETERNALBLUE exploit tool. This vulnerability was publicly disclosed by the Shadow Brokers group in April 2017, and was addressed by Microsoft in March 2017 with MS17-010. Once a successful infection has occurred, the malware encrypts users’ systems and prompts demand of a $300 payment to return access. For detailed analysis on the Petya attack playbook, please see our blog from the Unit 42 threat research team.

Preventions:

Palo Alto Networks customers are protected through our Next-Generation Security Platform, which employs a breach prevention-based approach that automatically stops threats across the attack lifecycle. Palo Alto Networks customers are protected from Petya ransomware through multiple complementary prevention controls across the platform, including:

• WildFire classifies all known samples as malware, automatically blocking malicious content from being delivered to users.
• AutoFocus tracks the attack for threat analytics and hunting via the Petya tag.
• Threat Prevention
  • Enforces IPS signatures (content release: 688-2964) for the SMB vulnerability exploit (CVE-2017-0144– MS17-010) likely used in this attack.
  • Blocks the malicious payload via “Virus/Win32.WGeneric.mkldr” and “Virus/Win32.WGeneric.mkknd” signatures.
• GlobalProtect extends WildFire and Threat Prevention protections to ensure consistent coverage for remote locations and users.
• Traps prevents initial infection associated with the MEDoc software update using the child process protection and DLL-hijacking rules (content updates available here, account required). Propagation of the malware related to usage of Mimikatz can be prevented via local analysis and WildFire cloud query.
• App-ID should be employed to control usage of SMB and WMI traffic throughout the network, only enabling it where necessary, including disabling older versions of protocols that pose higher risk (e.g. SMBv1).
• Multi-Factor Authentication (MFA) can stop the usage of valid credentials, which were potentially leveraged to infect additional systems across the network.
• Segmentation to observe and block malicious traffic between user-defined zones, preventing the lateral spread of Petya. You can further apply a Zero-Trust architecture to your network, driving microsegmentation within zones.

NOTE: We are continuously monitoring the Petya situation and will update this post with additional details on protections as they arise.

For best practices on preventing ransomware with the Palo Alto Networks Next-Generation Security Platform, please refer to our Knowledge Base article. We strongly recommend that all Windows users ensure they have the latest patches made available by Microsoft installed, including versions of software that have reached end-of-life support. For the latest on the Petya attack playbook, please see the Unit 42 post. Join our on-demand webcast covering the threat context and preventions for Petya here.

Version summary:

June 27, 2017 – 8:00 PM PT

• Added details on protection offered by App-ID

June 28, 2017 - 1:15 PM PT

• Added details on MFA and segmentation

July 6, 2017 - 5:15 PM PT

• Added details on Traps