A Series of Unfortunate Events: Where Malware Meets Murphy
summary
Hundreds of gigabytes of files end up encrypted, AV/firewall/SIEM all fail, and nightly backup exists but is one day out of date; a one terabyte backup contains >100,000 files. Windows Explorer shows 1,954 hits while PowerShell finds 9,924 because of the 260-character path limit in legacy Win32 APIs; fixes use subst mappings, icacls for ACL export/import, and robocopy with backup rights to restore long paths. Network restore is impractical (40 Mbps ≈ 35 hours) so a shipped drive restores in ~4 hours; high-entropy detection on the first 1k bytes enables selective recovery.
AI-written summary · about
chapters (24)
- 0:00ABOUT ME
- 0:30INCIDENT HANDLING PROCESS
- 1:02PREPARATION
- 1:40CONTAINMENT
- 3:03TRYING TO OPEN A FILE
- 5:02SERVICE DESK
- 5:27ENCRYPTED FILES EVERYWHERE
- 5:57WHICH FILES ARE ENCRYPTED?
- 7:12FILE EXPLORER
- 8:13MSDN
- 9:24CONFUSED...
- 9:41EUREKA!
- 10:13THE ERSATZ ELEVATOR
- 10:55NO ACCESS FOR YOU
- 12:35ROBOCOPY FTW!
- 14:09POWERSHELL & ROBOCOPY
- 14:35LET'S REBUILD
- 16:21THE WIDE WINDOW
- 17:30BACKUP DRIVE FILESYSTEM WOES
- 18:07MS TO THE RESCUE
- 18:53MORE AFFECTED FILES
- 20:46SMARTER FILTERING
- 21:42CALCULATE ENTROPY
- 22:22LESSONS LEARNED/RECOMMENDATIONS
related talks
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
38mRansomware and Backups: A Multi-Layered Defense Strategy
38mProtecting Database Backups From Ransomware and Malicious Intent
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
42mStart Covering Your Bases And Stop Chasing APT Headlines
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
52mAdventures in Underland: Hacker Tricks to Stay Under the...