I would like to restrict my AD users so they can only modify/create let say 10 files per minute via samba share. I think it can help to reduce destructive effects of ransomware activity. Is it possible to implement this on Windows Server 2012R2? FSRM + powershell maybe?

  • 1
    That won't help really... Jun 28 '17 at 21:55
  • @BaronSamedi1958 Why?
    – Kristopher
    Jun 29 '17 at 8:24
  • Well, for one thing, all you're doing is rate limiting ransomware, which is probably not the desired outcome. For another, when it hits large files that take more than 6 seconds to encrypt, it's completely useless. Seriously, what are you going to say when you come in Monday morning after a ransomware attack? "Thanks to my script, only 36,000 files were encrypted by the ransomware we got hit with!" Jun 30 '17 at 4:44

Why don't you create a file screen that blocks encrypted files for the most common Ransom-ware? Then run a Powershell script that notifies you on attempts to write those file types. You can then add some features to disable the AD account until you investigate further.

List to block https://fsrm.experiant.ca/

Ps script https://github.com/nexxai/CryptoBlocker/blob/master/DeployCryptoBlocker.ps1

GITHUB crytoblocker https://github.com/nexxai/CryptoBlocker

How to: https://gallery.technet.microsoft.com/scriptcenter/protect-your-file-server-f3722fce

  • As far I know some newer ransomware like Petya uses the same file extensions for encrypted files as extensions of the orgin files so it won't help.
    – Kristopher
    Jun 29 '17 at 8:23
  • Well every new flavor of ransomware uses it's own file extension. However, don't you like your odds of being protected from the ones we already know about? The list is updated almost daily, the one script provides a way to update your file screens as often as you like. You can also disable old protocols like smb1, and patch all your systems, keep backups that are not reachable at all too. It shouldn't be difficult to stress the importance of being fully patched. One web hosting company just payed $1 million to unencrypted their sites. Honda shut down production for a full day. It's worth it.
    – veel84
    Jun 29 '17 at 9:36
  • I like your idea, kinda another option. I would even push it farther the idea by blocking .htm / .html file creation too, as its rare a normal user start creating html file on a fileshare
    – yagmoth555
    Jun 29 '17 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.