How Varonis protects against ransomware such as Emotet, Netwalker and Co. protects

The number of incidents is steadily increasing

Already in last post on the subject of Netwalker, employee awareness plays a key role in the defence against malware in general and Netwalker in particular. Phishing continues to be a dangerous problem, as the latest report on the state of IT security in Germany from the BSI points out. And unfortunately, nobody is really safe from it. If the content and timing are right, anyone can become a victim. Companies are therefore well advised to take additional measures, such as proactive threat detection and intelligent user analyses.

Protection through behaviour-based threat detection

Varonis can alert you to early signs of compromise by ransomware attackers with behaviour-based threat models for each phase of the kill chain. The tool creates cross-platform user profiles and combines subtle deviations in email behaviour with suspicious login events, network connections and data access. This correlation makes it possible to identify threats that are overlooked by other security solutions - with significantly fewer false positives.

For example, Varonis detects phishing attempts by monitoring Microsoft Exchange and Exchange Online mailboxes for malicious file attachments that match known patterns often used as templates. And with Varonis Edge's proxy-based detection capabilities, security leaders can recognise that a user is downloading an attachment or clicking on a link in the body of an email that leads to a malicious netwalker download.

As soon as a compromised user account starts to access sensitive data, behaviour-based threat detection kicks in. Using various behavioural models, the software learns the "normal behaviour", i.e. how certain users regularly access data. If noticeable changes then occur, such as access to an unusually large amount of data, the system can issue a corresponding warning. It also distinguishes between manual and automated actions if a user begins to exfiltrate and encrypt files in an abnormal way. In this way, ransomware attacks can be stopped at an early stage. Security managers can even automate responses to certain user behaviour, deactivate the account and disconnect active connections.

By monitoring file system activity, Varonis quickly detects if ransomware is storing known penetration tools on the hard drive (this is a common netwalker tactic) or if a user is scanning file shares for files containing passwords or other sensitive data.

Reduce the attack surface with the least privilege model

These searches are "successful" from an attacker's point of view primarily because each employee (with their user account) usually has access to far more files than they actually need. The latest data risk report shows, that on average 22 percent of a company's folders are accessible to every employee and in every second company all employees have access to more than 1,000 sensitive files.

In addition to effective detection of an attack, the reduction of access rights also plays an important role. This is because the potential impact of a compromise should be minimised as much as possible. The least privilege model ensures that everyone only has the access they need for their work. The platform recognises access rights that are too broad and enables automated processes to reduce them. This not only significantly reduces the attack surface, but also the damage that a ransomware attack can cause.

Speed is of the essence

If you suspect that you have fallen victim to Netwalker ransomware, you should act quickly. Varonis allows you to query all file accesses and changes made by a specific user over a defined period of time in order to locate affected files and restore the correct versions.

Detect your own defences - now Ransomware Risk Assessment book

Ransomware is constantly evolving and becoming increasingly difficult to detect. Companies must proactively limit their attack surface and introduce effective detection methods to successfully combat these threats. In addition to trained employees, the right technologies and partners are also important. The data-centred Varonis platform can be attributed a key role in this context. This is because it focuses on a holistic view of the IT infrastructure.

If you want to find out how susceptible your company is to a ransomware attack and where you are vulnerable and open to attack, you can register for the free Ransomware Risk Assessment from Varnonis.

Get in touch with us in advance to evaluate in an initial dialogue whether Varonis could be a suitable element in your IT infrastructure.