Registry Integrity and Access Monitoring – Snare is able to monitor registry locations for access or changes to any and all registry keys stored within a system. Quite often, ransomware will look to persist post boot, so monitoring key registry locations that enable this behaviour can act as an early warning system.

File Integrity and Access Monitoring – Snare is able to monitor files or directories for access and changes to specified locations. In the event of a ransomware attack, large amounts of file changes will occur, generating 1000’s of FIM/FAM logs in a short time. Snare products are even able to provide customisable threshold alerts, meaning alerts can be generated if more than 100 file events occur within 5 second window (usually the sign of a process making bulk adjustments to files).

Proxy Logs –  Proxy logs can be searched using the standard reports where the logs were collected using the Snare agents. the proxy logs maybe a path to the Internet to access malicious content or used to exfiltrate data. By reviewing the top sites or users it may highlight who and where the activity was coming from for compromised users and systems. The standard reports are located here:

Reports\Application Audit\Proxy Servers 

User Lateral Movement –  Logins to other systems can be detected using the standard login reports to show which systems users are logging into. The report can be cloned as many times as needed with each of them having additional filters applied for specific users or groups of users to filter down to specific user account logging in to multiple systems. This could be an indication of account compromise if the user access was not legitimate. Out of hours login reports can also be run to see which accounts are being used in non standard working hours when the accounts would not normally be used. Location for user login activity is found here for Windows and other operating systems.  

Reports\Operating Systems\Login Activity 

User and group changes can also be tracked and reported on. One of the changes the malware does is to change or add users to have privileged access. Tracking if users have been added or removed, system policy changes occurring, audit logs being cleared can be a sign of malicious activity with the attacker trying to hide their tracks, group and group member changes as well as specific user changes for additional access. Snare Central has reports for tracking administrative user activity located here: 

Reports\Operating Systems\Administrative Activity 

Process Execution –  Reviewing process execution can be complicated in understanding what are normal applications used on the corporate network what is not. However getting context of what is run then seeing what is abnormal can be done with reviewing the activities of the key systems then expand to review other systems as needed. Where application white listing has been implemented the risk maybe lower, but not all organisations have been able to white list all application usage. Snare Central has some base reports that allow the user to show what commands are being run on the systems. If the customer has sysmon also installed (https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon) then it will provide additional information and parameters used in commands that are run including PowerShell commands. The reports can be cloned as many times as needed and adjusted with additional filters to search for specific applications or exclude known whitelisted applications and then report on other unknown applications. Location for process Monitoring can be found here: 

Reports\Operating Systems\Process Monitoring 

Network Activity Monitoring – Where Snare Central is collecting firewall, router, switches and other logs from snort or other IDS/IPS systems it can help correlate actions performed by systems and/or users to show where downloads of malicious content or where data is being exfiltrated to. Reports can be created for a variety of network devices with filters being created to look for specific IP addresses of interest from either internal or external sites. In the case of this malware using the source address of the SolarWinds server and any other compromised server may help narrow down what the actions were and how they were performed on the corporate network. Some of the standard Network activity monitoring reports can be found here: 

Reports\Network 

Database Activity Monitoring  – Database Activity Monitoring as provided using our Snare MS SQL agent can help provide additional information on what corporate data was accessed inside the MS SQL Server databases. By tracking the access to the databases and reviewing the contents of the SQL commands and who was running them it can provide additional forensics combined with the other user activity performed on the systems. There are several standard reports in Snare Central that provide details on Admin and DBA activity, Database Activity, and usage for specific commands. Users can report on login activity, use of user rights, review specific SQL events, report on objects accessed by using custom reports and tune them based on the customer’s specific naming conventions. Some of the standard reports can be found here: 

Reports\Application Audit\MSSQL Server 

These are just a few of the XFL (Extended Forensic Logging) capabilities of Snare products.