![\"A](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-1.-Example-of-C2-usage-across-the-stages-of-a-human-operated-ransomware-attack-1024x393.png\")
Ransomware has evolved from a pre-programmed commodity threat to a complex threat that\u2019s human-driven, adaptive, and focused on a larger scale. These days, ransomware attacks go beyond encryption and usually involve significant data theft as well to maximize the potential harm to the target, therefore increasing their chances of receiving a higher payout. Attackers engage in double extortion, demanding victims either pay the ransom or stolen confidential information is leaked and encrypted data remains inaccessible. As such, successful ransomware attacks can have lasting, damaging impacts on targets.<\/p>\n\n\n\n
As ransomware attacks continue to target various entities, including businesses, governments, critical infrastructure<\/a>, educational institutions<\/a>, and healthcare<\/a> facilities, organizations much be prepared to defend networks against human-operated attacks and other sophisticated threats. Microsoft Defender for Endpoint\u2019s updated network protection enables organizations to protect against these C2-based attacks by blocking any outbound traffic attempting to connect to malicious C2 servers, even if attackers manage to gain initial access to a device. Additionally, network protection is continuously informed by our integrated threat intelligence to identify active C2 infrastructure and uses machine learning models to quickly assess information on domains and IPs.<\/p>\n\n\n\n This blog details how the new C2 blocking capability<\/a> in Microsoft Defender for Endpoint\u2019s network protection works. We show examples of how network protection functions with other technologies in Microsoft Defender for Endpoint to deliver comprehensive protection against C2-based attacks. Lastly, we discuss how our threat research and use of advanced machine learning models inform network protection to intelligently block ransomware and C2-based attacks before widespread impact.<\/p>\n\n\n\n The following cases of human-operated ransomware attacks from our threat data and investigations show how the new C2 blocking capability in network protection stop attacks and, in some cases, could have prevented attacks much earlier.<\/p>\n\n\n\n In early October 2022, we observed an attack leveraging the Raspberry Robin worm<\/a> as the initial access vector. Upon launch by the user, the attack attempted to connect to the domain tddshht[.]com <\/em>via HTTP using msiexec.exe<\/em> to download a TrueBot payload. As part of these attacks, TrueBot is typically downloaded to a user’s local application data directory where Windows Management Instrumentation (WMI) is used to run the TrueBot DLL using rundll32<\/em>. In this case, network protection was enabled in the environment and blocked the C2 communication from msiexec.exe<\/em> to tddshht[.]com<\/em>, which prevented TrueBot from being downloaded and launched, disrupting the attack.<\/p>\n\n\n\n In similar attacks<\/a> on organizations originating from Raspberry Robin, we\u2019ve seen TrueBot lead to Cobalt Strike for post-exploitation human-operated ransomware attacks. After launching TrueBot, we observed various follow-on actions, such as reconnaissance, persistence via scheduled tasks, and ransomware deployment.<\/p>\n\n\n\n In another ransomware-related case from March 2022, Microsoft researchers discovered a LockBit ransomware attack that was successfully detected and blocked. LockBit is an encryptor payload leveraged by many different operators who specialize in the post-exploitation phase of the attack as part ransomware as a service. In this case, there were multiple security products in different segments of the environment, and we didn\u2019t have visibility of the initial access vector. As the attackers moved laterally within the network, we observed the operator using the Cobalt Strike framework for the post-exploitation stages of the attack, using Remote Desktop Protocol (RDP) with Rclone for data exfiltration, and LockBit at the final encryption stage. The encryption attempt followed the exfiltration stage by just two hours.<\/p>\n\n\n\n Throughout the attack, Microsoft Defender for Endpoint proactively displayed repeated alerts for the targeted customer that an active hands-on-keyboard attacker was active on their network, as well as repeated Cobalt Strike activity alerts and suspicious behaviors. Microsoft Defender Antivirus\u2019s<\/a> behavior detections repeatedly alerted and blocked Cobalt Strike in addition to fully blocking the attack\u2019s LockBit encryptor payload, preventing impact on the subset of the network that had onboarded to Microsoft Defender for Endpoint.<\/p>\n\n\n\n Prior to this attack, network protection had already flagged the Cobalt Strike C2 domain sikescomposites[.]com<\/em> as malicious. Had network protection C2 protection been enabled across the organization, then the Cobalt Strike C2 server would have been automatically blocked \u2013 further disrupting this attack earlier in the attack chain and potentially preventing or delaying the data exfiltration impact of the attack.<\/p>\n\n\n\n The network protection intelligence on the C2 was sourced two weeks before the attack in February 2022 through expert intelligence from Microsoft Threat Intelligence Center (MSTIC) and also incriminated via Cobalt Strike configuration extraction monitoring. Microsoft Defender for Endpoint could have disrupted this LockBit attack much earlier had network protection been enabled. Moreover, even if the attacker used a different or new payload, network protection would have blocked the attack if it used the same C2 infrastructure. The diagram below illustrates the timeline of events in this ransomware incident.<\/p>\n\n\n\n The range of protection capabilities in Microsoft Defender for Endpoint<\/a> ensure our customers are provided with synchronous protection, integrated remediation, and actionable alerts against these C2-based attacks. The combination of technologies and features within Defender for Endpoint assures customers that their assets are adequately protected.<\/p>\n\n\n\n Network protection<\/a> blocks any outbound traffic when an application attempts to connect to known malicious C2 and informs customers of the block.<\/p>\n\n\n\n Network protection then sends this intelligence to Microsoft Defender Antivirus<\/a>, which remediates the process against known malware that attempted the C2 connection. Customers are then notified of these actions on the Defender for Endpoint portal, where they can see the attack chain, follow remediation steps, or do further investigation.<\/p>\n\n\n\n Network protection uses a dynamic reputation database that stores information on IPs, domains, and URLs gathered from a wide range of sources including threat research, detonation, adversary tracking, memory scanning, and active C2 web scanning. These activities lead to identifying C2 servers operated by human-operated ransomware actors and botnet actors and discovering compromised IPs and domains associated with known nation-state actors.<\/p>\n\n\n\n Network protection is aided by machine learning models that incriminate IP addresses used for C2 by inspecting network traffic telemetry. These models are trained on an extensive data set and use a diverse feature set, including DNS records, prevalence, location, and associations with compromised files or domains. Our threat experts\u2019 knowledge further helps refine these models, which are re-trained and redeployed daily to adapt to the ever-changing threat landscape.<\/p>\n\n\n\n Attackers often rely heavily on leveraging C2 communications to start and progress attacks, including human-operated ransomware attacks. C2 infrastructure enables attackers to control infected devices, perform malicious activities, and quickly adapt to their target environment in the pursuit of organizations\u2019 valuable data and assets.<\/p>\n\n\n\n Breaking this link to C2 infrastructure disrupts attacks\u2014either by stopping it completely or delaying its progression, allowing more time for the SOC to investigate and mitigate the intrusion. Microsoft Defender for Endpoint\u2019s network protection<\/a> capability identifies and blocks connections to C2 infrastructure used in human-operated ransomware attacks, leveraging techniques like machine learning and intelligent indicators of compromise (IOC) identification.<\/p>\n\n\n\n Microsoft customers can use the new C2 blocking capability to prevent malicious C2 IP and domain access by enabling network protection. Network protection examines network metadata to match them to threat-related patterns and determines the true nature of C2 connections. Enhanced by continuously fine-tuned machine learning models and constant threat intelligence updates, Microsoft Defender for Endpoint can take appropriate actions to block malicious C2 connections and stop malware from launching or propagating. Customers can also refer to our Tech community blog post<\/a> for guidance on validating functionality and more information on C2 detection and remediation.<\/p>\n\n\n\n In addition to enabling network protection<\/a> C2 blocking, it\u2019s recommended to follow the general best practices to defend your network against human-operated ransomware attacks<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Providing advanced protection against increasingly sophisticated human-operated ransomware, Microsoft Defender for Endpoint\u2019s network protection leverages threat intelligence and machine learning to block command-and-control (C2) communications.<\/p>\n","protected":false},"author":153,"featured_media":124514,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3663],"topic":[3687],"products":[3690,3694],"threat-intelligence":[3735],"tags":[3898,3776,3904,3802,3803],"coauthors":[3380],"class_list":["post-124506","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-research","topic-threat-intelligence","products-microsoft-defender","products-microsoft-defender-for-endpoint","threat-intelligence-ransomware","tag-elevation-of-privilege","tag-human-operated-ransomware","tag-lockbit","tag-ransomware","tag-ransomware-as-a-service"],"yoast_head":"\nNetwork protection detecting C2 activity in various attacks<\/h2>\n\n\n\n
Disrupting the ransomware attack chain<\/h3>\n\n\n\n
![\"Raspberry](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-2.-Raspberry-Robin-incident-disruption-preventing-attack-progression-1024x259.png\")
Stopping ransomware activity before it could wreak havoc<\/h3>\n\n\n\n
![\"Two](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-3.-LockBit-ransomware-incident-timeline-1024x349.png\")
End-to-end protection against C2-based attacks<\/h2>\n\n\n\n
![\"The](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-4.-Sample-C2-activity-alert.png\")
![\"Diagram](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-5.-MDE-end-to-end-protection-1024x484.png\")
![\"Training](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/11\/Figure-6.-Machine-learning-pipeline-to-generate-new-intelligence-1024x411.png\")
Preventing C2-based attacks<\/h2>\n\n\n\n