Windows Ransomware Detection and Protection: Securing Windows Endpoints, the Cloud, and Infrastructure Using Microsoft Intune, Sentinel, and Defender

Cover
Title Page
Copyright and Credits
Contributors
About the reviewers
Table of Contents
Preface
Part 1:Ransomware Basics
Chapter 1: Ransomware Attack Vectors and the Threat Landscape
	Evolution of ransomware
	Attack vectors
		Exploiting known vulnerabilities
		Access through credential stuffing
		Access through brute-force attacks
		Access through a compromised workstation or end user machine
	How does ransomware work?
		Diavol ransomware
		Conti ransomware
		Sodinokibi/REvil ransomware
		LockBit ransomware
		The latest additions
		Looking at the big picture
	Identity-based attacks
		How are vulnerabilities utilized for attacks?
		Monitoring vulnerabilities
	Summary
Chapter 2: Building a Secure Foundation
	Zero-trust design principles
		Identity pillar – zero-trust maturity
		Device pillar – zero-trust maturity
		Network pillar – zero-trust maturity
		Application pillar – zero-trust maturity
		Data pillar – zero-trust maturity
	Network access
	Vulnerability and patch management
		Vulnerability management example for PrintNightmare
	Identity and access control
		User life cycle management
		Ensuring strong passwords and authentication methods
		Role-based access control and using least privilege
	Security logging and monitoring
	A secure foundation within Microsoft Azure
	Summary
Part 2:Protect and Detect
Chapter 3: Security Monitoring Using Microsoft Sentinel and Defender
	Technical requirements
	Understanding Microsoft Sentinel and Microsoft Defender
	Designing and implementing Microsoft Sentinel
	Collecting logs and data sources
	Performing Kusto and log queries
	Seeing the full picture
	Creating analytics rules and handling incidents
		Analytics rules
	Ransomware detection – looking for initial compromise
	Detecting vulnerabilities with Defender
	Summary
Chapter 4: Ransomware Countermeasures – Windows Endpoints, Identity, and SaaS
	Technical requirements
	Securing endpoints
		ASR rules
	Microsoft Defender and antimalware
	Update management
	Securing Microsoft Office apps
	Securing the web browser
	Other miscellaneous endpoint countermeasures
		DNS filtering
		PowerShell
		SMB protocol
		LOLBins
		Default applications
	Securing user identity
	Securing Active Directory
	Securing email services
		Protecting the domains
		Protecting the content and URLs
	Other countermeasures
	Summary
Chapter 5: Ransomware Countermeasures – Microsoft Azure Workloads
	Technical requirements
	Network segmentation and design
	Identity and access management in Microsoft Azure
	Hub-and-spoke virtual networks
	The anatomy of a VM in Azure
		Microsoft Defender for Servers
	Azure Policy
	Azure Backup
	Overall recommendations for Azure-based workloads
	Summary
Chapter 6: Ransomware Countermeasures – Networking and Zero-Trust Access
	Attackers and lateral movement
	Providing users with secure access to services
		Microsoft
		Citrix
		Cloudflare
		SASE
		File access
	Remote management services
	DDoS protection
	Summary
Chapter 7: Protecting Information Using Azure Information Protection and Data Protection
	Technical requirements
	Data exfiltration
	Data classification
	Azure Information Protection
	DLP features and the future of AIP
	Encryption on SQL Server
	Best practices for backups and data protection
	Summary
Part 3:Assume Breach
Chapter 8: Ransomware Forensics
	You got ransomware, now what?
	Phase one – validating an alert
	Phase two – discovering the impact
	Phase three – understanding the attack vector and what to look for
	A manual approach
	An automatic approach
	Closing the door
	Summary
Chapter 9: Monitoring the Threat Landscape
	How to monitor the threat landscape
	Threat management
	What does the future hold?
	Summary
Chapter 10: Best Practices for Protecting Windows from Ransomware Attacks
	Best practices and security settings in Windows
	Remote desktop management
	Administrative shares
	LAPS and restrict usage of local accounts
	Windows Firewall best practices
	Tamper Protection
	Automatic patching of infrastructure
	File Server Resource Manager and file groups
	Other top tips to protect against ransomware
	Summary
Index
Other Books You May Enjoy