{"id":5689,"date":"2022-04-27T03:54:50","date_gmt":"2022-04-27T03:54:50","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=5689"},"modified":"2022-05-12T06:53:35","modified_gmt":"2022-05-12T06:53:35","slug":"stuff-to-do-after-a-cryptolocker-infection","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/stuff-to-do-after-a-cryptolocker-infection","title":{"rendered":"Stuff to do after a cryptolocker infection"},"content":{"rendered":"
  1. Disconnect all computers and servers from the Internet ( to stop hack and stop encrypting )\u00a0<\/li>
  2. Find the Source of the Hack ( Sometimes this can be as easy as finding the server and PC that started Encryption )<\/li>
  3. Restore Servers from a backup to a point in time before the hack and rebuild and compromised workstations<\/li>
  4. Check customer passwords on https:\/\/hashcast.axur.com\/pricing or haveibeenpwned\u00a0<\/li><\/ol>

    Tools<\/p>

    1. MFA , MFA , MFA<\/li>
    2. Windows and Software and Hardware Updates everywhere ( Reduce attack vector )\u00a0<\/li>
    3. Install a good antivirus like SentinelOne to stop future hacks<\/li>
    4. Make sure your Router has things like IPS and Web Filtering<\/li>
    5. Make sure you have a good spam filter in front\u00a0<\/li>
    6. Run pingcastle.com report on AD Security\u00a0<\/li>
    7. https:\/\/pariswells.com\/blog\/research\/ioc-scanners-after-crypto<\/a><\/li>
    8. Randomize Local Administrator passwords with a tool like\u00a0Local Administrator Password S<\/a>olution (LAPS) to prevent lateral movement using local accounts with shared passwords<\/li>
    9. User Phish Testing<\/li><\/ol>","protected":false},"excerpt":{"rendered":"

      Disconnect all computers and servers from the Internet ( to stop hack and stop encrypting )\u00a0Find the Source of the Hack ( Sometimes this can be as […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-5689","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/5689","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=5689"}],"version-history":[{"count":4,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/5689\/revisions"}],"predecessor-version":[{"id":5766,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/5689\/revisions\/5766"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=5689"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=5689"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=5689"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}