A Windows Service to detect if it has been shutdown and hibernate if multiple instances are.
Released as open source by NCC Group Plc - http://www.nccgroup.com/
Developed by Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com
https://github.com/nccgroup/KilledProcessCanary
Released under AGPL see LICENSE for more information
Certain threat actors stop a number of services / kill a number of processes prior to encrypting with their ransomware. We deploy a number of canary processes which keep track of each other. If these services are stopped (via net stop or similar) and not during a host shutdown we fire a Canary DNS token and hibernate the host. By doing this we will:
- Minimize the impact / likelihood of successful encryption
- Give the best chance of key recovery from RAM
Should work on any version of Windows
Simply:
- Creates a mutex and shares the number of running instances
- net stop on a Canary service will cause it decrement
- if that falls below 2 we fire a DNS canary token with the hostname and hibernate the host
- Replace the Canary Token URL
- Compile SWOLLENRIVER
- Deploy into typical paths for at least TWO targetted Windows Services
- Install the Windows Services e.g.
New-Service -Name "MSSQL" -BinaryPathName "C:\Program Files\Microsoft SQL Server\sqlserver.exe"
- Start
- ... profit
The genesis of the idea came from a discussion with Harry..
- https://www.carbonblack.com/blog/vmware-carbon-black-tau-ryuk-ransomware-technical-analysis/
- https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
e.g.
net stop avpsus /y
net stop McAfeeDLPAgentService /y
net stop mfewc /y
net stop BMR Boot Service /y
net stop NetBackup BMR MTFTP Service /y
This uses a Canary Token (https://www.canarytokens.org/) DNS token to encode the hostname and the fact it is hibernating via the auxiliary information mechanism documented here https://docs.canarytokens.org/guide/dns-token.html#creating-a-dns-token.
For this to work you will need to replace the REPLACEME here: https://github.com/nccgroup/KilledProcessCanary/blob/master/Program.cs#L241
An example alert seen is as follows:
