RPC Firewall Dubbed 'Ransomware Kill Switch' Released to Open Source

guest · Nov 18, 2021

RPC Firewall Dubbed 'Ransomware Kill Switch' Released to Open Source
November 10, 2021
https://www.securityweek.com/rpc-firewall-dubbed-ransomware-kill-switch-released-open-source

Today at Black Hat London, Zero Networks announced the release of its RPC firewall – also dubbed the ‘ransomware kill switch’ – into open source. The tool provides granular control over RPC, capable of blocking the use of lateral movement hacker tools and stopping almost all ransomware in its tracks.

Microsoft’s Remote Procedure Call (MS-RPCE) lies at the heart of Windows. It effectively manages the relationship between clients and servers – if a client requests from a server, it goes through RPC; This happens both locally and between remote devices.
Click to expand...

RPC was introduced into Windows back in the days of Windows 2000 and has been ever-present since then.

Normal attempts to block RPC ports could rapidly cause the network to fail. For example, the most sensitive servers such as Domain Controllers must have RPC services open to any asset in the network for the domain to function properly. “If you try to shut down RPC, you will be shutting down the functionality of Windows itself,” added Lakunishok.
Click to expand...

The common hacker tools used for lateral movement – such as BloodHound, mimikatz, CobaltStrike, PS-Empire, PsExec and WMIC – all use RPC. But you cannot simply block the use of RPC. And even if you are able to detect something, detection is often too late.

To solve this problem and provide auditing, visibility and control over RPC calls, Zero Networks developed an agent that scans the machine and finds the RPC processes.

“The agent hooks into those it finds in a legitimate manner (nothing malicious) so that it sees everything.,” Lakunishok told SecurityWeek.

“We provide full auditing and visibility so we can see, these are calling these RPC functions. Finally, we can map who is calling which RPC function. We can also create a whitelist. Even though RPC supports thousands of functions, only a few are really needed. We allow those and block everything else. We provide granular control over what RPC is doing. We can block the rest. Down the drain goes most of the attack tactics, and tools.”
Click to expand...

Zero Networks has now open sourced this tool. It can be found on GitHub.
Click to expand...

guest · Nov 18, 2021

RPC Firewall 1.0.2 Released (November 17, 2021)
Website
Download

1.0.2

Various performance & memory improvements

Click to expand...

guest · Dec 28, 2021

RPC Firewall 1.0.3 Released (December 28, 2021)
Website
Download

1.0.3

Event Log changed to "RPCFW"

Event Log size is now 2MB

C++ Refactoring

Code is signed, resolves #9

Click to expand...

guest · Feb 8, 2022

RPC Firewall 1.0.5 Released (February 6, 2022)
Website
Download

v1.0.5

feat (README): Documented a simple persistency method

v1.0.4

Small bug fix in rpcMessages.dll.

Configuration for blocking common RPC attacks, also with compatible Sigma rules:.

Click to expand...

Log in or Sign up

RPC Firewall Dubbed 'Ransomware Kill Switch' Released to Open Source

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

RPC Firewall Dubbed 'Ransomware Kill Switch' Released to Open Source

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches