Hello, welcome to the Thursday, January 28th, 2021 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Hopefully a big win for the good guys today was the takedown of the Emotet botnet. Now, Emotet, of course, has been around

for a while. What's a little bit different about this takedown is that it didn't just involve

a couple of command and control servers, but authorities in the Ukraine did serve a search warrant on the actual headquarters

of what is believed to be the Amotet Crew, the company, the organization behind this botnet.

Some good video of that particular rate, kind of showing you the sophisticated adversaries we are

up against here and what equipment they are using. After all, MWThead is probably one of the

more prolific botnets and crimeware operations. Of course, Emwoodhead operates like many of these

crimeware operations that we have talked about

in the past by essentially sending emails with Word documents and macros that the user

is then supposed to execute.

Even with Emot Head Gun, this technique is probably not going away. So today we have a diary by Daniel looking at whether or not the attack surface reduction

rules that Microsoft introduced can help us mitigate some of these attacks.

And yes, to celebrate the takedown, he is using Emotet as an example.

So with the attack surface reduction rules, you can monitor and even block some behavior

that you would not like to see on your Windows systems. You may say why didn't Microsoft introduce or include

rules like this by default? Well, sometimes this behavior is needed, so these are rules that you

have to apply carefully. And Daniel looked at a couple that look promising, like, for example,

to block all office applications from creating child processes. Daniel had mixed results

with all of this, and for example, the detection of the child process itself didn't trigger, but what did trigger

is block process creations from originating from PSX and WMI commands.

And yes, Emotet does use WMI as part of its macro code.

...