Hello there,
is it possible, to catch actions from actual Ransomware like noPetya with IPS between subnets?
Example: Clients in one subnet, servers in another one. One client is infected by noPetya, which starts encrypting files on a file-share (server-subnet).
Thats a normal file-access via TCP445 (CIFS/SMB). Is this behaviour (ip-/frame-pattern) detectable via ips/snort or does ist just seeing a normal file-access from a client?
If not, how can i prevent the access from infected clients, which on-access-scanner (sophos endpoint) cannot see/recognize the infection due to missing pattern-files (0day)?
Thx,
Manuel
This thread was automatically locked due to age.
