この記事は公開されてから1年以上経過しています。情報が古い可能性がありますので、ご注意ください。
こんにちは。たかやまです。
こちらはNetApp Cloud Insights – Cloud Secureを使ってみた(導入編)のつづきになります。
今回は実際にCloud Secureをランサムウェア攻撃をおこない検知してみたいと思います。
実際の検知画面
実際にCloudSecureが攻撃を検知した際の画面です。
こちらの画面から攻撃内容、攻撃者情報などを確認することができ、ユーザのアクセス制御やONTAP Snapshotの取得も行うことができます。
では、実際にランサムウェア攻撃を行いイベントを検知する流れを行っていきたいと思います。
やってみる
公式手順にある方法を使って、Linuxインスタンスがウイルス検知された場合の動作を確認してみたいと思います。
参考 : Cloud Secure: Simulating an Attack
事前準備
1.データコレクターの停止
すでにデータコレクターが動作している場合には、一旦停止します。
間違ったパスワードを入力し、接続を失敗させます。
ステータスがエラーになっていればOKです。
2.マウント
FSx for NetAppのボリュームをマウントをします。
今回はCloudSecure Agentに付属しているスクリプトで検知を行っていくので、マウントするサーバはCloudSecure Agentサーバを利用します。
NetAppの監視機能Fpolicyが必要なため、マウントの際はFpolicyがサポートするnfsバージョン4.0を指定してください。
Do not mount NFS version 4.1; it is not supported by Fpolicy.
mkdir /fsx
mount -t nfs -o vers=4.0 <svm名>:<path> /fsx実行ログ(展開)
$ sudo su -
最終ログイン: 2022/05/25 (水) 07:33:52 UTC日時 pts/0
# mkdir /fsx
# mount -t nfs svm-00490bef764612ee2.fs-06b3d2e945d454c19.fsx.ap-northeast-1.amazonaws.com:/taka_vol1 /fsx3.事前ファイル作成
次に暗号化するダミーファイルを作成します。
cd /fsx
vi createfiles.sh
# 以下のスクリプトを記述
for i in {000..1000}
do
echo hello > "File${i}.txt"
done
echo 3 > /proc/sys/vm/drop_caches ; syncスクリプトを実行してファイルを作成します。
FSx for NetAppのボリュームに1000個ダミーファイルができると思います。
chmod 777 ./createfiles.sh
./createfiles.sh実行ログ(展開)
# cd /fsx
# vi createfiles.sh
# chmod 777 ./createfiles.sh
# ./createfiles.sh
# ls
createfiles.sh File0083.txt File0167.txt File0251.txt File0335.txt File0419.txt File0503.txt File0587.txt File0671.txt File0755.txt File0839.txt File0923.txt
File0000.txt File0084.txt File0168.txt File0252.txt File0336.txt File0420.txt File0504.txt File0588.txt File0672.txt File0756.txt File0840.txt File0924.txt
File0001.txt File0085.txt File0169.txt File0253.txt File0337.txt File0421.txt File0505.txt File0589.txt File0673.txt File0757.txt File0841.txt File0925.txt
File0002.txt File0086.txt File0170.txt File0254.txt File0338.txt File0422.txt File0506.txt File0590.txt File0674.txt File0758.txt File0842.txt File0926.txt
File0003.txt File0087.txt File0171.txt File0255.txt File0339.txt File0423.txt File0507.txt File0591.txt File0675.txt File0759.txt File0843.txt File0927.txt
File0004.txt File0088.txt File0172.txt File0256.txt File0340.txt File0424.txt File0508.txt File0592.txt File0676.txt File0760.txt File0844.txt File0928.txt
File0005.txt File0089.txt File0173.txt File0257.txt File0341.txt File0425.txt File0509.txt File0593.txt File0677.txt File0761.txt File0845.txt File0929.txt
File0006.txt File0090.txt File0174.txt File0258.txt File0342.txt File0426.txt File0510.txt File0594.txt File0678.txt File0762.txt File0846.txt File0930.txt
File0007.txt File0091.txt File0175.txt File0259.txt File0343.txt File0427.txt File0511.txt File0595.txt File0679.txt File0763.txt File0847.txt File0931.txt
File0008.txt File0092.txt File0176.txt File0260.txt File0344.txt File0428.txt File0512.txt File0596.txt File0680.txt File0764.txt File0848.txt File0932.txt
File0009.txt File0093.txt File0177.txt File0261.txt File0345.txt File0429.txt File0513.txt File0597.txt File0681.txt File0765.txt File0849.txt File0933.txt
File0010.txt File0094.txt File0178.txt File0262.txt File0346.txt File0430.txt File0514.txt File0598.txt File0682.txt File0766.txt File0850.txt File0934.txt
File0011.txt File0095.txt File0179.txt File0263.txt File0347.txt File0431.txt File0515.txt File0599.txt File0683.txt File0767.txt File0851.txt File0935.txt
File0012.txt File0096.txt File0180.txt File0264.txt File0348.txt File0432.txt File0516.txt File0600.txt File0684.txt File0768.txt File0852.txt File0936.txt
File0013.txt File0097.txt File0181.txt File0265.txt File0349.txt File0433.txt File0517.txt File0601.txt File0685.txt File0769.txt File0853.txt File0937.txt
File0014.txt File0098.txt File0182.txt File0266.txt File0350.txt File0434.txt File0518.txt File0602.txt File0686.txt File0770.txt File0854.txt File0938.txt
File0015.txt File0099.txt File0183.txt File0267.txt File0351.txt File0435.txt File0519.txt File0603.txt File0687.txt File0771.txt File0855.txt File0939.txt
File0016.txt File0100.txt File0184.txt File0268.txt File0352.txt File0436.txt File0520.txt File0604.txt File0688.txt File0772.txt File0856.txt File0940.txt
File0017.txt File0101.txt File0185.txt File0269.txt File0353.txt File0437.txt File0521.txt File0605.txt File0689.txt File0773.txt File0857.txt File0941.txt
File0018.txt File0102.txt File0186.txt File0270.txt File0354.txt File0438.txt File0522.txt File0606.txt File0690.txt File0774.txt File0858.txt File0942.txt
File0019.txt File0103.txt File0187.txt File0271.txt File0355.txt File0439.txt File0523.txt File0607.txt File0691.txt File0775.txt File0859.txt File0943.txt
File0020.txt File0104.txt File0188.txt File0272.txt File0356.txt File0440.txt File0524.txt File0608.txt File0692.txt File0776.txt File0860.txt File0944.txt
File0021.txt File0105.txt File0189.txt File0273.txt File0357.txt File0441.txt File0525.txt File0609.txt File0693.txt File0777.txt File0861.txt File0945.txt
File0022.txt File0106.txt File0190.txt File0274.txt File0358.txt File0442.txt File0526.txt File0610.txt File0694.txt File0778.txt File0862.txt File0946.txt
File0023.txt File0107.txt File0191.txt File0275.txt File0359.txt File0443.txt File0527.txt File0611.txt File0695.txt File0779.txt File0863.txt File0947.txt
File0024.txt File0108.txt File0192.txt File0276.txt File0360.txt File0444.txt File0528.txt File0612.txt File0696.txt File0780.txt File0864.txt File0948.txt
File0025.txt File0109.txt File0193.txt File0277.txt File0361.txt File0445.txt File0529.txt File0613.txt File0697.txt File0781.txt File0865.txt File0949.txt
File0026.txt File0110.txt File0194.txt File0278.txt File0362.txt File0446.txt File0530.txt File0614.txt File0698.txt File0782.txt File0866.txt File0950.txt
File0027.txt File0111.txt File0195.txt File0279.txt File0363.txt File0447.txt File0531.txt File0615.txt File0699.txt File0783.txt File0867.txt File0951.txt
File0028.txt File0112.txt File0196.txt File0280.txt File0364.txt File0448.txt File0532.txt File0616.txt File0700.txt File0784.txt File0868.txt File0952.txt
File0029.txt File0113.txt File0197.txt File0281.txt File0365.txt File0449.txt File0533.txt File0617.txt File0701.txt File0785.txt File0869.txt File0953.txt
File0030.txt File0114.txt File0198.txt File0282.txt File0366.txt File0450.txt File0534.txt File0618.txt File0702.txt File0786.txt File0870.txt File0954.txt
File0031.txt File0115.txt File0199.txt File0283.txt File0367.txt File0451.txt File0535.txt File0619.txt File0703.txt File0787.txt File0871.txt File0955.txt
File0032.txt File0116.txt File0200.txt File0284.txt File0368.txt File0452.txt File0536.txt File0620.txt File0704.txt File0788.txt File0872.txt File0956.txt
File0033.txt File0117.txt File0201.txt File0285.txt File0369.txt File0453.txt File0537.txt File0621.txt File0705.txt File0789.txt File0873.txt File0957.txt
File0034.txt File0118.txt File0202.txt File0286.txt File0370.txt File0454.txt File0538.txt File0622.txt File0706.txt File0790.txt File0874.txt File0958.txt
File0035.txt File0119.txt File0203.txt File0287.txt File0371.txt File0455.txt File0539.txt File0623.txt File0707.txt File0791.txt File0875.txt File0959.txt
File0036.txt File0120.txt File0204.txt File0288.txt File0372.txt File0456.txt File0540.txt File0624.txt File0708.txt File0792.txt File0876.txt File0960.txt
File0037.txt File0121.txt File0205.txt File0289.txt File0373.txt File0457.txt File0541.txt File0625.txt File0709.txt File0793.txt File0877.txt File0961.txt
File0038.txt File0122.txt File0206.txt File0290.txt File0374.txt File0458.txt File0542.txt File0626.txt File0710.txt File0794.txt File0878.txt File0962.txt
File0039.txt File0123.txt File0207.txt File0291.txt File0375.txt File0459.txt File0543.txt File0627.txt File0711.txt File0795.txt File0879.txt File0963.txt
File0040.txt File0124.txt File0208.txt File0292.txt File0376.txt File0460.txt File0544.txt File0628.txt File0712.txt File0796.txt File0880.txt File0964.txt
File0041.txt File0125.txt File0209.txt File0293.txt File0377.txt File0461.txt File0545.txt File0629.txt File0713.txt File0797.txt File0881.txt File0965.txt
File0042.txt File0126.txt File0210.txt File0294.txt File0378.txt File0462.txt File0546.txt File0630.txt File0714.txt File0798.txt File0882.txt File0966.txt
File0043.txt File0127.txt File0211.txt File0295.txt File0379.txt File0463.txt File0547.txt File0631.txt File0715.txt File0799.txt File0883.txt File0967.txt
File0044.txt File0128.txt File0212.txt File0296.txt File0380.txt File0464.txt File0548.txt File0632.txt File0716.txt File0800.txt File0884.txt File0968.txt
File0045.txt File0129.txt File0213.txt File0297.txt File0381.txt File0465.txt File0549.txt File0633.txt File0717.txt File0801.txt File0885.txt File0969.txt
File0046.txt File0130.txt File0214.txt File0298.txt File0382.txt File0466.txt File0550.txt File0634.txt File0718.txt File0802.txt File0886.txt File0970.txt
File0047.txt File0131.txt File0215.txt File0299.txt File0383.txt File0467.txt File0551.txt File0635.txt File0719.txt File0803.txt File0887.txt File0971.txt
File0048.txt File0132.txt File0216.txt File0300.txt File0384.txt File0468.txt File0552.txt File0636.txt File0720.txt File0804.txt File0888.txt File0972.txt
File0049.txt File0133.txt File0217.txt File0301.txt File0385.txt File0469.txt File0553.txt File0637.txt File0721.txt File0805.txt File0889.txt File0973.txt
File0050.txt File0134.txt File0218.txt File0302.txt File0386.txt File0470.txt File0554.txt File0638.txt File0722.txt File0806.txt File0890.txt File0974.txt
File0051.txt File0135.txt File0219.txt File0303.txt File0387.txt File0471.txt File0555.txt File0639.txt File0723.txt File0807.txt File0891.txt File0975.txt
File0052.txt File0136.txt File0220.txt File0304.txt File0388.txt File0472.txt File0556.txt File0640.txt File0724.txt File0808.txt File0892.txt File0976.txt
File0053.txt File0137.txt File0221.txt File0305.txt File0389.txt File0473.txt File0557.txt File0641.txt File0725.txt File0809.txt File0893.txt File0977.txt
File0054.txt File0138.txt File0222.txt File0306.txt File0390.txt File0474.txt File0558.txt File0642.txt File0726.txt File0810.txt File0894.txt File0978.txt
File0055.txt File0139.txt File0223.txt File0307.txt File0391.txt File0475.txt File0559.txt File0643.txt File0727.txt File0811.txt File0895.txt File0979.txt
File0056.txt File0140.txt File0224.txt File0308.txt File0392.txt File0476.txt File0560.txt File0644.txt File0728.txt File0812.txt File0896.txt File0980.txt
File0057.txt File0141.txt File0225.txt File0309.txt File0393.txt File0477.txt File0561.txt File0645.txt File0729.txt File0813.txt File0897.txt File0981.txt
File0058.txt File0142.txt File0226.txt File0310.txt File0394.txt File0478.txt File0562.txt File0646.txt File0730.txt File0814.txt File0898.txt File0982.txt
File0059.txt File0143.txt File0227.txt File0311.txt File0395.txt File0479.txt File0563.txt File0647.txt File0731.txt File0815.txt File0899.txt File0983.txt
File0060.txt File0144.txt File0228.txt File0312.txt File0396.txt File0480.txt File0564.txt File0648.txt File0732.txt File0816.txt File0900.txt File0984.txt
File0061.txt File0145.txt File0229.txt File0313.txt File0397.txt File0481.txt File0565.txt File0649.txt File0733.txt File0817.txt File0901.txt File0985.txt
File0062.txt File0146.txt File0230.txt File0314.txt File0398.txt File0482.txt File0566.txt File0650.txt File0734.txt File0818.txt File0902.txt File0986.txt
File0063.txt File0147.txt File0231.txt File0315.txt File0399.txt File0483.txt File0567.txt File0651.txt File0735.txt File0819.txt File0903.txt File0987.txt
File0064.txt File0148.txt File0232.txt File0316.txt File0400.txt File0484.txt File0568.txt File0652.txt File0736.txt File0820.txt File0904.txt File0988.txt
File0065.txt File0149.txt File0233.txt File0317.txt File0401.txt File0485.txt File0569.txt File0653.txt File0737.txt File0821.txt File0905.txt File0989.txt
File0066.txt File0150.txt File0234.txt File0318.txt File0402.txt File0486.txt File0570.txt File0654.txt File0738.txt File0822.txt File0906.txt File0990.txt
File0067.txt File0151.txt File0235.txt File0319.txt File0403.txt File0487.txt File0571.txt File0655.txt File0739.txt File0823.txt File0907.txt File0991.txt
File0068.txt File0152.txt File0236.txt File0320.txt File0404.txt File0488.txt File0572.txt File0656.txt File0740.txt File0824.txt File0908.txt File0992.txt
File0069.txt File0153.txt File0237.txt File0321.txt File0405.txt File0489.txt File0573.txt File0657.txt File0741.txt File0825.txt File0909.txt File0993.txt
File0070.txt File0154.txt File0238.txt File0322.txt File0406.txt File0490.txt File0574.txt File0658.txt File0742.txt File0826.txt File0910.txt File0994.txt
File0071.txt File0155.txt File0239.txt File0323.txt File0407.txt File0491.txt File0575.txt File0659.txt File0743.txt File0827.txt File0911.txt File0995.txt
File0072.txt File0156.txt File0240.txt File0324.txt File0408.txt File0492.txt File0576.txt File0660.txt File0744.txt File0828.txt File0912.txt File0996.txt
File0073.txt File0157.txt File0241.txt File0325.txt File0409.txt File0493.txt File0577.txt File0661.txt File0745.txt File0829.txt File0913.txt File0997.txt
File0074.txt File0158.txt File0242.txt File0326.txt File0410.txt File0494.txt File0578.txt File0662.txt File0746.txt File0830.txt File0914.txt File0998.txt
File0075.txt File0159.txt File0243.txt File0327.txt File0411.txt File0495.txt File0579.txt File0663.txt File0747.txt File0831.txt File0915.txt File0999.txt
File0076.txt File0160.txt File0244.txt File0328.txt File0412.txt File0496.txt File0580.txt File0664.txt File0748.txt File0832.txt File0916.txt File1000.txt
File0077.txt File0161.txt File0245.txt File0329.txt File0413.txt File0497.txt File0581.txt File0665.txt File0749.txt File0833.txt File0917.txt
File0078.txt File0162.txt File0246.txt File0330.txt File0414.txt File0498.txt File0582.txt File0666.txt File0750.txt File0834.txt File0918.txt
File0079.txt File0163.txt File0247.txt File0331.txt File0415.txt File0499.txt File0583.txt File0667.txt File0751.txt File0835.txt File0919.txt
File0080.txt File0164.txt File0248.txt File0332.txt File0416.txt File0500.txt File0584.txt File0668.txt File0752.txt File0836.txt File0920.txt
File0081.txt File0165.txt File0249.txt File0333.txt File0417.txt File0501.txt File0585.txt File0669.txt File0753.txt File0837.txt File0921.txt
File0082.txt File0166.txt File0250.txt File0334.txt File0418.txt File0502.txt File0586.txt File0670.txt File0754.txt File0838.txt File0922.txt4.データコレクターの起動
停止した、データコレクターを起動します。
さきほど誤ったパスワードを入力した部分を正しいパスワードに戻します。
ステータスがRunningになっていればOKです。
ランサムウェア実行
ランサムウェアシュミレートスクリプトの実行
CloudSecure Agentにランサムウェアシュミレートスクリプトが用意されているので、こちらを実行していきます。
cd /opt/netapp/cloudsecure/agent/install
./ransomware_simulator.sh -e -i /fsx実行ログ(展開)
# cd /opt/netapp/cloudsecure/agent/install
# ./ransomware_simulator.sh -e -i /fsx
Encryption key is saved in /opt/netapp/cloudsecure/cloudsecure-agent-1.507.0/install/encryption-key, which can be used for restoring the files.
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0000.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/createfiles.sh
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0001.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0002.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0003.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0004.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0005.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0006.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0007.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0008.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0009.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0010.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0011.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0012.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0013.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0014.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0015.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0016.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0017.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0018.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0019.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0020.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0021.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0022.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0023.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0024.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0025.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0026.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0027.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0028.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0029.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0030.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0031.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0032.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0033.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0034.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0035.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0036.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0037.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0038.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0039.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0040.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0041.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0042.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0043.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0044.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0045.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0046.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0047.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0048.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0049.txt
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File0050.txt
・
・
・
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
Encrypted /fsx/File1000.txt
Total number of files encrypted: 1002CloudSecure確認
Cloud Secure確認 - All Activity -
ランサムウェア実行後、CloudSecureコンソールを確認してみます。
まずは、アクティビティを確認してみます。
左ペインのFORENSICS -> Activity Forensicsからアクティビティを確認できます。
今回の実行されたランサムウェアのアクティビティが確認できます。
①フィルター
項目ごとにフィルターをかけることができます。
今回はDeviceでフィルターをかけています。
②期間
表示する期間を指定できます。
カスタム期間で細かい日にち/時間指定も可能です。
③アクティビティタイプ
以下のアクティビティに対応しています。
| アクティビティ | 内容 |
|---|---|
| Change Group Ownership | ファイルやフォルダーのグループ所有権の変更 |
| Change Owner | ファイルまたはフォルダの所有者が別のユーザーに変更 |
| Change Permission | ファイルまたはフォルダの権限の変更 |
| Create | ファイルまたはフォルダーの作成 |
| Delete | ファイルまたはフォルダーの削除 |
| Read | ファイル読み込み |
| Read Metadata | フォルダー監視オプションを有効にした場合 ・Windowsでフォルダを開く ・Linuxでlsを実行 |
| Rename | ファイルまたはフォルダの名前変更 |
| Write | ファイルへのデータ書き込み |
| Write Metadata | 権限が変更など、ファイルのメタデータ書き込み |
| Other Change | 上記以外のイベント |
④エンティティタイプ
ファイルの拡張子が表示されます。
Cloud Secure確認 - ALERTS -
次に実際に検知されたアラートを確認します。
左ペインのALERTSからアラート状況を確認できます。
①Potential Attacks
ここにはランサムウェアやサボタージュ攻撃と思われるイベントが出力されます。
②Warnings
こちらはユーザの動作に異常(ファイルアクセスの異常な増加など)が見られた場合に出力されます。
では実際に検知されたRansomware Attackのイベント詳細を見てみます。
AlertID/Potential Attacksのリンクをクリックすると詳細に飛ぶことができます。
詳細に飛ぶと、攻撃内容/関連ユーザ/攻撃対象ボリュームの情報が表示されます。
こちらが冒頭でご紹介した画面になります。
①攻撃内容
ここでは以下の情報を読み取ることができます。
- 影響を受けるボリュームとファイルの数
- 検出の概要
- 攻撃中のファイルアクティビティを示すグラフ
他に以下の操作をこちらで行うことが可能です。
Manage Access/Restore Access: 関連ユーザのアクセスを制御Re-Take Snapshots: ONTAPのSnapshot取得
②関連ユーザ
ここには攻撃者と見られる関連ユーザが表示されれます。
今回はCloudSecure側で自動的にユーザアクセスをBlockしていることがわかります。
実際にフォルダにアクセスしようとすると、FSx for NetAppからブロックされていることが確認できます。
ls -l /fsx
ls: cannot access '/fsx': Permission denied
ls -l /
total 24
lrwxrwxrwx. 1 root root 7 Nov 3 2020 bin -> usr/bin
dr-xr-xr-x. 6 root root 4096 May 18 04:36 boot
drwxr-xr-x. 16 root root 2600 May 25 09:11 dev
drwxr-xr-x. 96 root root 8192 May 25 09:11 etc
d?????????? ? ? ? ? ? fsx
drwxr-xr-x. 5 root root 49 May 18 10:03 home
lrwxrwxrwx. 1 root root 7 Nov 3 2020 lib -> usr/lib
lrwxrwxrwx. 1 root root 9 Nov 3 2020 lib64 -> usr/lib64
drwxr-xr-x. 2 root root 6 Nov 3 2020 media
drwxr-xr-x. 2 root root 6 Nov 3 2020 mnt
drwxr-xr-x. 3 root root 20 May 18 05:03 opt
dr-xr-xr-x. 138 root root 0 May 25 09:11 proc
drwxr-xr-x. 4 root root 4096 May 25 09:10 root
drwxr-xr-x. 25 root root 800 May 25 11:08 run
lrwxrwxrwx. 1 root root 8 Nov 3 2020 sbin -> usr/sbin
drwxr-xr-x. 2 root root 6 Nov 3 2020 srv
dr-xr-xr-x. 13 root root 0 May 25 09:11 sys
drwxrwxrwt. 12 root root 4096 May 26 05:06 tmp
drwxr-xr-x. 13 root root 158 Jun 3 2021 usr
drwxr-xr-x. 20 root root 278 May 18 04:35 var③攻撃対象ボリューム
攻撃対象となっているボリュームの情報が表示されます。
Encrypted Filesのリンクをクリックすることで、実際にどのファイルが暗号化されているか確認することもできます。
ファイルリストア
ランサムウェア攻撃から検知までの一連の流れを確認できたので最後にファイルをリストアしたいと思います。
今回はONTAPのスナップショットを利用して、ファイルをリストアしたいと思います。
ONTAPではファイルシステム上に.snapshotという名前のサブディレクトリでsnapshotを管理しています。
ls -l /fsx/.snapshot
total 2280
drwxr-xr-x. 2 root root 774144 May 25 08:40 backup-0a6ace9bc41358822
drwxr-xr-x. 2 root root 774144 May 26 01:39 cloudsecure_attack_auto_1653529240504
drwxr-xr-x. 2 root root 774144 May 26 01:39 cloudsecure_manual_1653538840435攻撃前のsnapshotが保管されている場合はこちらからファイルをコピーすることで復旧することができます。
ls /fsx
createfiles.sh.crypt File0000.txt.crypt ... File1000.txt.crypt #.cryptがついてるものは暗号化されている
ls /fsx/.snapshot/backup-0a6ace9bc41358822
createfiles.sh File0000.txt ... File1000.txt #.cryptがついていない暗号化前のファイルがあることがわかる
cp -p /fsx/.snapshot/backup-0a6ace9bc41358822/createfiles.sh /fsx
ls -l /fsx/createfiles*
-rwxrwxrwx. 1 root root 101 May 25 08:37 /fsx/createfiles.sh
-rw-r--r--. 1 root root 128 May 26 01:39 /fsx/createfiles.sh.crypt参考 : NFS クライアントまたは SMB クライアント上の Snapshot コピーからファイルをリストアします
実行ログ(展開)
# ls /fsx
createfiles.sh.crypt File0125.txt.crypt File0251.txt.crypt File0377.txt.crypt File0503.txt.crypt File0629.txt.crypt File0755.txt.crypt File0881.txt.crypt
File0000.txt.crypt File0126.txt.crypt File0252.txt.crypt File0378.txt.crypt File0504.txt.crypt File0630.txt.crypt File0756.txt.crypt File0882.txt.crypt
File0001.txt.crypt File0127.txt.crypt File0253.txt.crypt File0379.txt.crypt File0505.txt.crypt File0631.txt.crypt File0757.txt.crypt File0883.txt.crypt
File0002.txt.crypt File0128.txt.crypt File0254.txt.crypt File0380.txt.crypt File0506.txt.crypt File0632.txt.crypt File0758.txt.crypt File0884.txt.crypt
File0003.txt.crypt File0129.txt.crypt File0255.txt.crypt File0381.txt.crypt File0507.txt.crypt File0633.txt.crypt File0759.txt.crypt File0885.txt.crypt
File0004.txt.crypt File0130.txt.crypt File0256.txt.crypt File0382.txt.crypt File0508.txt.crypt File0634.txt.crypt File0760.txt.crypt File0886.txt.crypt
File0005.txt.crypt File0131.txt.crypt File0257.txt.crypt File0383.txt.crypt File0509.txt.crypt File0635.txt.crypt File0761.txt.crypt File0887.txt.crypt
File0006.txt.crypt File0132.txt.crypt File0258.txt.crypt File0384.txt.crypt File0510.txt.crypt File0636.txt.crypt File0762.txt.crypt File0888.txt.crypt
File0007.txt.crypt File0133.txt.crypt File0259.txt.crypt File0385.txt.crypt File0511.txt.crypt File0637.txt.crypt File0763.txt.crypt File0889.txt.crypt
File0008.txt.crypt File0134.txt.crypt File0260.txt.crypt File0386.txt.crypt File0512.txt.crypt File0638.txt.crypt File0764.txt.crypt File0890.txt.crypt
File0009.txt.crypt File0135.txt.crypt File0261.txt.crypt File0387.txt.crypt File0513.txt.crypt File0639.txt.crypt File0765.txt.crypt File0891.txt.crypt
File0010.txt.crypt File0136.txt.crypt File0262.txt.crypt File0388.txt.crypt File0514.txt.crypt File0640.txt.crypt File0766.txt.crypt File0892.txt.crypt
File0011.txt.crypt File0137.txt.crypt File0263.txt.crypt File0389.txt.crypt File0515.txt.crypt File0641.txt.crypt File0767.txt.crypt File0893.txt.crypt
File0012.txt.crypt File0138.txt.crypt File0264.txt.crypt File0390.txt.crypt File0516.txt.crypt File0642.txt.crypt File0768.txt.crypt File0894.txt.crypt
File0013.txt.crypt File0139.txt.crypt File0265.txt.crypt File0391.txt.crypt File0517.txt.crypt File0643.txt.crypt File0769.txt.crypt File0895.txt.crypt
File0014.txt.crypt File0140.txt.crypt File0266.txt.crypt File0392.txt.crypt File0518.txt.crypt File0644.txt.crypt File0770.txt.crypt File0896.txt.crypt
File0015.txt.crypt File0141.txt.crypt File0267.txt.crypt File0393.txt.crypt File0519.txt.crypt File0645.txt.crypt File0771.txt.crypt File0897.txt.crypt
File0016.txt.crypt File0142.txt.crypt File0268.txt.crypt File0394.txt.crypt File0520.txt.crypt File0646.txt.crypt File0772.txt.crypt File0898.txt.crypt
File0017.txt.crypt File0143.txt.crypt File0269.txt.crypt File0395.txt.crypt File0521.txt.crypt File0647.txt.crypt File0773.txt.crypt File0899.txt.crypt
File0018.txt.crypt File0144.txt.crypt File0270.txt.crypt File0396.txt.crypt File0522.txt.crypt File0648.txt.crypt File0774.txt.crypt File0900.txt.crypt
File0019.txt.crypt File0145.txt.crypt File0271.txt.crypt File0397.txt.crypt File0523.txt.crypt File0649.txt.crypt File0775.txt.crypt File0901.txt.crypt
File0020.txt.crypt File0146.txt.crypt File0272.txt.crypt File0398.txt.crypt File0524.txt.crypt File0650.txt.crypt File0776.txt.crypt File0902.txt.crypt
File0021.txt.crypt File0147.txt.crypt File0273.txt.crypt File0399.txt.crypt File0525.txt.crypt File0651.txt.crypt File0777.txt.crypt File0903.txt.crypt
File0022.txt.crypt File0148.txt.crypt File0274.txt.crypt File0400.txt.crypt File0526.txt.crypt File0652.txt.crypt File0778.txt.crypt File0904.txt.crypt
File0023.txt.crypt File0149.txt.crypt File0275.txt.crypt File0401.txt.crypt File0527.txt.crypt File0653.txt.crypt File0779.txt.crypt File0905.txt.crypt
File0024.txt.crypt File0150.txt.crypt File0276.txt.crypt File0402.txt.crypt File0528.txt.crypt File0654.txt.crypt File0780.txt.crypt File0906.txt.crypt
File0025.txt.crypt File0151.txt.crypt File0277.txt.crypt File0403.txt.crypt File0529.txt.crypt File0655.txt.crypt File0781.txt.crypt File0907.txt.crypt
File0026.txt.crypt File0152.txt.crypt File0278.txt.crypt File0404.txt.crypt File0530.txt.crypt File0656.txt.crypt File0782.txt.crypt File0908.txt.crypt
File0027.txt.crypt File0153.txt.crypt File0279.txt.crypt File0405.txt.crypt File0531.txt.crypt File0657.txt.crypt File0783.txt.crypt File0909.txt.crypt
File0028.txt.crypt File0154.txt.crypt File0280.txt.crypt File0406.txt.crypt File0532.txt.crypt File0658.txt.crypt File0784.txt.crypt File0910.txt.crypt
File0029.txt.crypt File0155.txt.crypt File0281.txt.crypt File0407.txt.crypt File0533.txt.crypt File0659.txt.crypt File0785.txt.crypt File0911.txt.crypt
File0030.txt.crypt File0156.txt.crypt File0282.txt.crypt File0408.txt.crypt File0534.txt.crypt File0660.txt.crypt File0786.txt.crypt File0912.txt.crypt
File0031.txt.crypt File0157.txt.crypt File0283.txt.crypt File0409.txt.crypt File0535.txt.crypt File0661.txt.crypt File0787.txt.crypt File0913.txt.crypt
File0032.txt.crypt File0158.txt.crypt File0284.txt.crypt File0410.txt.crypt File0536.txt.crypt File0662.txt.crypt File0788.txt.crypt File0914.txt.crypt
File0033.txt.crypt File0159.txt.crypt File0285.txt.crypt File0411.txt.crypt File0537.txt.crypt File0663.txt.crypt File0789.txt.crypt File0915.txt.crypt
File0034.txt.crypt File0160.txt.crypt File0286.txt.crypt File0412.txt.crypt File0538.txt.crypt File0664.txt.crypt File0790.txt.crypt File0916.txt.crypt
File0035.txt.crypt File0161.txt.crypt File0287.txt.crypt File0413.txt.crypt File0539.txt.crypt File0665.txt.crypt File0791.txt.crypt File0917.txt.crypt
File0036.txt.crypt File0162.txt.crypt File0288.txt.crypt File0414.txt.crypt File0540.txt.crypt File0666.txt.crypt File0792.txt.crypt File0918.txt.crypt
File0037.txt.crypt File0163.txt.crypt File0289.txt.crypt File0415.txt.crypt File0541.txt.crypt File0667.txt.crypt File0793.txt.crypt File0919.txt.crypt
File0038.txt.crypt File0164.txt.crypt File0290.txt.crypt File0416.txt.crypt File0542.txt.crypt File0668.txt.crypt File0794.txt.crypt File0920.txt.crypt
File0039.txt.crypt File0165.txt.crypt File0291.txt.crypt File0417.txt.crypt File0543.txt.crypt File0669.txt.crypt File0795.txt.crypt File0921.txt.crypt
File0040.txt.crypt File0166.txt.crypt File0292.txt.crypt File0418.txt.crypt File0544.txt.crypt File0670.txt.crypt File0796.txt.crypt File0922.txt.crypt
File0041.txt.crypt File0167.txt.crypt File0293.txt.crypt File0419.txt.crypt File0545.txt.crypt File0671.txt.crypt File0797.txt.crypt File0923.txt.crypt
File0042.txt.crypt File0168.txt.crypt File0294.txt.crypt File0420.txt.crypt File0546.txt.crypt File0672.txt.crypt File0798.txt.crypt File0924.txt.crypt
File0043.txt.crypt File0169.txt.crypt File0295.txt.crypt File0421.txt.crypt File0547.txt.crypt File0673.txt.crypt File0799.txt.crypt File0925.txt.crypt
File0044.txt.crypt File0170.txt.crypt File0296.txt.crypt File0422.txt.crypt File0548.txt.crypt File0674.txt.crypt File0800.txt.crypt File0926.txt.crypt
File0045.txt.crypt File0171.txt.crypt File0297.txt.crypt File0423.txt.crypt File0549.txt.crypt File0675.txt.crypt File0801.txt.crypt File0927.txt.crypt
File0046.txt.crypt File0172.txt.crypt File0298.txt.crypt File0424.txt.crypt File0550.txt.crypt File0676.txt.crypt File0802.txt.crypt File0928.txt.crypt
File0047.txt.crypt File0173.txt.crypt File0299.txt.crypt File0425.txt.crypt File0551.txt.crypt File0677.txt.crypt File0803.txt.crypt File0929.txt.crypt
File0048.txt.crypt File0174.txt.crypt File0300.txt.crypt File0426.txt.crypt File0552.txt.crypt File0678.txt.crypt File0804.txt.crypt File0930.txt.crypt
File0049.txt.crypt File0175.txt.crypt File0301.txt.crypt File0427.txt.crypt File0553.txt.crypt File0679.txt.crypt File0805.txt.crypt File0931.txt.crypt
File0050.txt.crypt File0176.txt.crypt File0302.txt.crypt File0428.txt.crypt File0554.txt.crypt File0680.txt.crypt File0806.txt.crypt File0932.txt.crypt
File0051.txt.crypt File0177.txt.crypt File0303.txt.crypt File0429.txt.crypt File0555.txt.crypt File0681.txt.crypt File0807.txt.crypt File0933.txt.crypt
File0052.txt.crypt File0178.txt.crypt File0304.txt.crypt File0430.txt.crypt File0556.txt.crypt File0682.txt.crypt File0808.txt.crypt File0934.txt.crypt
File0053.txt.crypt File0179.txt.crypt File0305.txt.crypt File0431.txt.crypt File0557.txt.crypt File0683.txt.crypt File0809.txt.crypt File0935.txt.crypt
File0054.txt.crypt File0180.txt.crypt File0306.txt.crypt File0432.txt.crypt File0558.txt.crypt File0684.txt.crypt File0810.txt.crypt File0936.txt.crypt
File0055.txt.crypt File0181.txt.crypt File0307.txt.crypt File0433.txt.crypt File0559.txt.crypt File0685.txt.crypt File0811.txt.crypt File0937.txt.crypt
File0056.txt.crypt File0182.txt.crypt File0308.txt.crypt File0434.txt.crypt File0560.txt.crypt File0686.txt.crypt File0812.txt.crypt File0938.txt.crypt
File0057.txt.crypt File0183.txt.crypt File0309.txt.crypt File0435.txt.crypt File0561.txt.crypt File0687.txt.crypt File0813.txt.crypt File0939.txt.crypt
File0058.txt.crypt File0184.txt.crypt File0310.txt.crypt File0436.txt.crypt File0562.txt.crypt File0688.txt.crypt File0814.txt.crypt File0940.txt.crypt
File0059.txt.crypt File0185.txt.crypt File0311.txt.crypt File0437.txt.crypt File0563.txt.crypt File0689.txt.crypt File0815.txt.crypt File0941.txt.crypt
File0060.txt.crypt File0186.txt.crypt File0312.txt.crypt File0438.txt.crypt File0564.txt.crypt File0690.txt.crypt File0816.txt.crypt File0942.txt.crypt
File0061.txt.crypt File0187.txt.crypt File0313.txt.crypt File0439.txt.crypt File0565.txt.crypt File0691.txt.crypt File0817.txt.crypt File0943.txt.crypt
File0062.txt.crypt File0188.txt.crypt File0314.txt.crypt File0440.txt.crypt File0566.txt.crypt File0692.txt.crypt File0818.txt.crypt File0944.txt.crypt
File0063.txt.crypt File0189.txt.crypt File0315.txt.crypt File0441.txt.crypt File0567.txt.crypt File0693.txt.crypt File0819.txt.crypt File0945.txt.crypt
File0064.txt.crypt File0190.txt.crypt File0316.txt.crypt File0442.txt.crypt File0568.txt.crypt File0694.txt.crypt File0820.txt.crypt File0946.txt.crypt
File0065.txt.crypt File0191.txt.crypt File0317.txt.crypt File0443.txt.crypt File0569.txt.crypt File0695.txt.crypt File0821.txt.crypt File0947.txt.crypt
File0066.txt.crypt File0192.txt.crypt File0318.txt.crypt File0444.txt.crypt File0570.txt.crypt File0696.txt.crypt File0822.txt.crypt File0948.txt.crypt
File0067.txt.crypt File0193.txt.crypt File0319.txt.crypt File0445.txt.crypt File0571.txt.crypt File0697.txt.crypt File0823.txt.crypt File0949.txt.crypt
File0068.txt.crypt File0194.txt.crypt File0320.txt.crypt File0446.txt.crypt File0572.txt.crypt File0698.txt.crypt File0824.txt.crypt File0950.txt.crypt
File0069.txt.crypt File0195.txt.crypt File0321.txt.crypt File0447.txt.crypt File0573.txt.crypt File0699.txt.crypt File0825.txt.crypt File0951.txt.crypt
File0070.txt.crypt File0196.txt.crypt File0322.txt.crypt File0448.txt.crypt File0574.txt.crypt File0700.txt.crypt File0826.txt.crypt File0952.txt.crypt
File0071.txt.crypt File0197.txt.crypt File0323.txt.crypt File0449.txt.crypt File0575.txt.crypt File0701.txt.crypt File0827.txt.crypt File0953.txt.crypt
File0072.txt.crypt File0198.txt.crypt File0324.txt.crypt File0450.txt.crypt File0576.txt.crypt File0702.txt.crypt File0828.txt.crypt File0954.txt.crypt
File0073.txt.crypt File0199.txt.crypt File0325.txt.crypt File0451.txt.crypt File0577.txt.crypt File0703.txt.crypt File0829.txt.crypt File0955.txt.crypt
File0074.txt.crypt File0200.txt.crypt File0326.txt.crypt File0452.txt.crypt File0578.txt.crypt File0704.txt.crypt File0830.txt.crypt File0956.txt.crypt
File0075.txt.crypt File0201.txt.crypt File0327.txt.crypt File0453.txt.crypt File0579.txt.crypt File0705.txt.crypt File0831.txt.crypt File0957.txt.crypt
File0076.txt.crypt File0202.txt.crypt File0328.txt.crypt File0454.txt.crypt File0580.txt.crypt File0706.txt.crypt File0832.txt.crypt File0958.txt.crypt
File0077.txt.crypt File0203.txt.crypt File0329.txt.crypt File0455.txt.crypt File0581.txt.crypt File0707.txt.crypt File0833.txt.crypt File0959.txt.crypt
File0078.txt.crypt File0204.txt.crypt File0330.txt.crypt File0456.txt.crypt File0582.txt.crypt File0708.txt.crypt File0834.txt.crypt File0960.txt.crypt
File0079.txt.crypt File0205.txt.crypt File0331.txt.crypt File0457.txt.crypt File0583.txt.crypt File0709.txt.crypt File0835.txt.crypt File0961.txt.crypt
File0080.txt.crypt File0206.txt.crypt File0332.txt.crypt File0458.txt.crypt File0584.txt.crypt File0710.txt.crypt File0836.txt.crypt File0962.txt.crypt
File0081.txt.crypt File0207.txt.crypt File0333.txt.crypt File0459.txt.crypt File0585.txt.crypt File0711.txt.crypt File0837.txt.crypt File0963.txt.crypt
File0082.txt.crypt File0208.txt.crypt File0334.txt.crypt File0460.txt.crypt File0586.txt.crypt File0712.txt.crypt File0838.txt.crypt File0964.txt.crypt
File0083.txt.crypt File0209.txt.crypt File0335.txt.crypt File0461.txt.crypt File0587.txt.crypt File0713.txt.crypt File0839.txt.crypt File0965.txt.crypt
File0084.txt.crypt File0210.txt.crypt File0336.txt.crypt File0462.txt.crypt File0588.txt.crypt File0714.txt.crypt File0840.txt.crypt File0966.txt.crypt
File0085.txt.crypt File0211.txt.crypt File0337.txt.crypt File0463.txt.crypt File0589.txt.crypt File0715.txt.crypt File0841.txt.crypt File0967.txt.crypt
File0086.txt.crypt File0212.txt.crypt File0338.txt.crypt File0464.txt.crypt File0590.txt.crypt File0716.txt.crypt File0842.txt.crypt File0968.txt.crypt
File0087.txt.crypt File0213.txt.crypt File0339.txt.crypt File0465.txt.crypt File0591.txt.crypt File0717.txt.crypt File0843.txt.crypt File0969.txt.crypt
File0088.txt.crypt File0214.txt.crypt File0340.txt.crypt File0466.txt.crypt File0592.txt.crypt File0718.txt.crypt File0844.txt.crypt File0970.txt.crypt
File0089.txt.crypt File0215.txt.crypt File0341.txt.crypt File0467.txt.crypt File0593.txt.crypt File0719.txt.crypt File0845.txt.crypt File0971.txt.crypt
File0090.txt.crypt File0216.txt.crypt File0342.txt.crypt File0468.txt.crypt File0594.txt.crypt File0720.txt.crypt File0846.txt.crypt File0972.txt.crypt
File0091.txt.crypt File0217.txt.crypt File0343.txt.crypt File0469.txt.crypt File0595.txt.crypt File0721.txt.crypt File0847.txt.crypt File0973.txt.crypt
File0092.txt.crypt File0218.txt.crypt File0344.txt.crypt File0470.txt.crypt File0596.txt.crypt File0722.txt.crypt File0848.txt.crypt File0974.txt.crypt
File0093.txt.crypt File0219.txt.crypt File0345.txt.crypt File0471.txt.crypt File0597.txt.crypt File0723.txt.crypt File0849.txt.crypt File0975.txt.crypt
File0094.txt.crypt File0220.txt.crypt File0346.txt.crypt File0472.txt.crypt File0598.txt.crypt File0724.txt.crypt File0850.txt.crypt File0976.txt.crypt
File0095.txt.crypt File0221.txt.crypt File0347.txt.crypt File0473.txt.crypt File0599.txt.crypt File0725.txt.crypt File0851.txt.crypt File0977.txt.crypt
File0096.txt.crypt File0222.txt.crypt File0348.txt.crypt File0474.txt.crypt File0600.txt.crypt File0726.txt.crypt File0852.txt.crypt File0978.txt.crypt
File0097.txt.crypt File0223.txt.crypt File0349.txt.crypt File0475.txt.crypt File0601.txt.crypt File0727.txt.crypt File0853.txt.crypt File0979.txt.crypt
File0098.txt.crypt File0224.txt.crypt File0350.txt.crypt File0476.txt.crypt File0602.txt.crypt File0728.txt.crypt File0854.txt.crypt File0980.txt.crypt
File0099.txt.crypt File0225.txt.crypt File0351.txt.crypt File0477.txt.crypt File0603.txt.crypt File0729.txt.crypt File0855.txt.crypt File0981.txt.crypt
File0100.txt.crypt File0226.txt.crypt File0352.txt.crypt File0478.txt.crypt File0604.txt.crypt File0730.txt.crypt File0856.txt.crypt File0982.txt.crypt
File0101.txt.crypt File0227.txt.crypt File0353.txt.crypt File0479.txt.crypt File0605.txt.crypt File0731.txt.crypt File0857.txt.crypt File0983.txt.crypt
File0102.txt.crypt File0228.txt.crypt File0354.txt.crypt File0480.txt.crypt File0606.txt.crypt File0732.txt.crypt File0858.txt.crypt File0984.txt.crypt
File0103.txt.crypt File0229.txt.crypt File0355.txt.crypt File0481.txt.crypt File0607.txt.crypt File0733.txt.crypt File0859.txt.crypt File0985.txt.crypt
File0104.txt.crypt File0230.txt.crypt File0356.txt.crypt File0482.txt.crypt File0608.txt.crypt File0734.txt.crypt File0860.txt.crypt File0986.txt.crypt
File0105.txt.crypt File0231.txt.crypt File0357.txt.crypt File0483.txt.crypt File0609.txt.crypt File0735.txt.crypt File0861.txt.crypt File0987.txt.crypt
File0106.txt.crypt File0232.txt.crypt File0358.txt.crypt File0484.txt.crypt File0610.txt.crypt File0736.txt.crypt File0862.txt.crypt File0988.txt.crypt
File0107.txt.crypt File0233.txt.crypt File0359.txt.crypt File0485.txt.crypt File0611.txt.crypt File0737.txt.crypt File0863.txt.crypt File0989.txt.crypt
File0108.txt.crypt File0234.txt.crypt File0360.txt.crypt File0486.txt.crypt File0612.txt.crypt File0738.txt.crypt File0864.txt.crypt File0990.txt.crypt
File0109.txt.crypt File0235.txt.crypt File0361.txt.crypt File0487.txt.crypt File0613.txt.crypt File0739.txt.crypt File0865.txt.crypt File0991.txt.crypt
File0110.txt.crypt File0236.txt.crypt File0362.txt.crypt File0488.txt.crypt File0614.txt.crypt File0740.txt.crypt File0866.txt.crypt File0992.txt.crypt
File0111.txt.crypt File0237.txt.crypt File0363.txt.crypt File0489.txt.crypt File0615.txt.crypt File0741.txt.crypt File0867.txt.crypt File0993.txt.crypt
File0112.txt.crypt File0238.txt.crypt File0364.txt.crypt File0490.txt.crypt File0616.txt.crypt File0742.txt.crypt File0868.txt.crypt File0994.txt.crypt
File0113.txt.crypt File0239.txt.crypt File0365.txt.crypt File0491.txt.crypt File0617.txt.crypt File0743.txt.crypt File0869.txt.crypt File0995.txt.crypt
File0114.txt.crypt File0240.txt.crypt File0366.txt.crypt File0492.txt.crypt File0618.txt.crypt File0744.txt.crypt File0870.txt.crypt File0996.txt.crypt
File0115.txt.crypt File0241.txt.crypt File0367.txt.crypt File0493.txt.crypt File0619.txt.crypt File0745.txt.crypt File0871.txt.crypt File0997.txt.crypt
File0116.txt.crypt File0242.txt.crypt File0368.txt.crypt File0494.txt.crypt File0620.txt.crypt File0746.txt.crypt File0872.txt.crypt File0998.txt.crypt
File0117.txt.crypt File0243.txt.crypt File0369.txt.crypt File0495.txt.crypt File0621.txt.crypt File0747.txt.crypt File0873.txt.crypt File0999.txt.crypt
File0118.txt.crypt File0244.txt.crypt File0370.txt.crypt File0496.txt.crypt File0622.txt.crypt File0748.txt.crypt File0874.txt.crypt File1000.txt.crypt
File0119.txt.crypt File0245.txt.crypt File0371.txt.crypt File0497.txt.crypt File0623.txt.crypt File0749.txt.crypt File0875.txt.crypt
File0120.txt.crypt File0246.txt.crypt File0372.txt.crypt File0498.txt.crypt File0624.txt.crypt File0750.txt.crypt File0876.txt.crypt
File0121.txt.crypt File0247.txt.crypt File0373.txt.crypt File0499.txt.crypt File0625.txt.crypt File0751.txt.crypt File0877.txt.crypt
File0122.txt.crypt File0248.txt.crypt File0374.txt.crypt File0500.txt.crypt File0626.txt.crypt File0752.txt.crypt File0878.txt.crypt
File0123.txt.crypt File0249.txt.crypt File0375.txt.crypt File0501.txt.crypt File0627.txt.crypt File0753.txt.crypt File0879.txt.crypt
File0124.txt.crypt File0250.txt.crypt File0376.txt.crypt File0502.txt.crypt File0628.txt.crypt File0754.txt.crypt File0880.txt.crypt
#
# ls /fsx/.snapshot/backup-0a6ace9bc41358822
createfiles.sh File0083.txt File0167.txt File0251.txt File0335.txt File0419.txt File0503.txt File0587.txt File0671.txt File0755.txt File0839.txt File0923.txt
File0000.txt File0084.txt File0168.txt File0252.txt File0336.txt File0420.txt File0504.txt File0588.txt File0672.txt File0756.txt File0840.txt File0924.txt
File0001.txt File0085.txt File0169.txt File0253.txt File0337.txt File0421.txt File0505.txt File0589.txt File0673.txt File0757.txt File0841.txt File0925.txt
File0002.txt File0086.txt File0170.txt File0254.txt File0338.txt File0422.txt File0506.txt File0590.txt File0674.txt File0758.txt File0842.txt File0926.txt
File0003.txt File0087.txt File0171.txt File0255.txt File0339.txt File0423.txt File0507.txt File0591.txt File0675.txt File0759.txt File0843.txt File0927.txt
File0004.txt File0088.txt File0172.txt File0256.txt File0340.txt File0424.txt File0508.txt File0592.txt File0676.txt File0760.txt File0844.txt File0928.txt
File0005.txt File0089.txt File0173.txt File0257.txt File0341.txt File0425.txt File0509.txt File0593.txt File0677.txt File0761.txt File0845.txt File0929.txt
File0006.txt File0090.txt File0174.txt File0258.txt File0342.txt File0426.txt File0510.txt File0594.txt File0678.txt File0762.txt File0846.txt File0930.txt
File0007.txt File0091.txt File0175.txt File0259.txt File0343.txt File0427.txt File0511.txt File0595.txt File0679.txt File0763.txt File0847.txt File0931.txt
File0008.txt File0092.txt File0176.txt File0260.txt File0344.txt File0428.txt File0512.txt File0596.txt File0680.txt File0764.txt File0848.txt File0932.txt
File0009.txt File0093.txt File0177.txt File0261.txt File0345.txt File0429.txt File0513.txt File0597.txt File0681.txt File0765.txt File0849.txt File0933.txt
File0010.txt File0094.txt File0178.txt File0262.txt File0346.txt File0430.txt File0514.txt File0598.txt File0682.txt File0766.txt File0850.txt File0934.txt
File0011.txt File0095.txt File0179.txt File0263.txt File0347.txt File0431.txt File0515.txt File0599.txt File0683.txt File0767.txt File0851.txt File0935.txt
File0012.txt File0096.txt File0180.txt File0264.txt File0348.txt File0432.txt File0516.txt File0600.txt File0684.txt File0768.txt File0852.txt File0936.txt
File0013.txt File0097.txt File0181.txt File0265.txt File0349.txt File0433.txt File0517.txt File0601.txt File0685.txt File0769.txt File0853.txt File0937.txt
File0014.txt File0098.txt File0182.txt File0266.txt File0350.txt File0434.txt File0518.txt File0602.txt File0686.txt File0770.txt File0854.txt File0938.txt
File0015.txt File0099.txt File0183.txt File0267.txt File0351.txt File0435.txt File0519.txt File0603.txt File0687.txt File0771.txt File0855.txt File0939.txt
File0016.txt File0100.txt File0184.txt File0268.txt File0352.txt File0436.txt File0520.txt File0604.txt File0688.txt File0772.txt File0856.txt File0940.txt
File0017.txt File0101.txt File0185.txt File0269.txt File0353.txt File0437.txt File0521.txt File0605.txt File0689.txt File0773.txt File0857.txt File0941.txt
File0018.txt File0102.txt File0186.txt File0270.txt File0354.txt File0438.txt File0522.txt File0606.txt File0690.txt File0774.txt File0858.txt File0942.txt
File0019.txt File0103.txt File0187.txt File0271.txt File0355.txt File0439.txt File0523.txt File0607.txt File0691.txt File0775.txt File0859.txt File0943.txt
File0020.txt File0104.txt File0188.txt File0272.txt File0356.txt File0440.txt File0524.txt File0608.txt File0692.txt File0776.txt File0860.txt File0944.txt
File0021.txt File0105.txt File0189.txt File0273.txt File0357.txt File0441.txt File0525.txt File0609.txt File0693.txt File0777.txt File0861.txt File0945.txt
File0022.txt File0106.txt File0190.txt File0274.txt File0358.txt File0442.txt File0526.txt File0610.txt File0694.txt File0778.txt File0862.txt File0946.txt
File0023.txt File0107.txt File0191.txt File0275.txt File0359.txt File0443.txt File0527.txt File0611.txt File0695.txt File0779.txt File0863.txt File0947.txt
File0024.txt File0108.txt File0192.txt File0276.txt File0360.txt File0444.txt File0528.txt File0612.txt File0696.txt File0780.txt File0864.txt File0948.txt
File0025.txt File0109.txt File0193.txt File0277.txt File0361.txt File0445.txt File0529.txt File0613.txt File0697.txt File0781.txt File0865.txt File0949.txt
File0026.txt File0110.txt File0194.txt File0278.txt File0362.txt File0446.txt File0530.txt File0614.txt File0698.txt File0782.txt File0866.txt File0950.txt
File0027.txt File0111.txt File0195.txt File0279.txt File0363.txt File0447.txt File0531.txt File0615.txt File0699.txt File0783.txt File0867.txt File0951.txt
File0028.txt File0112.txt File0196.txt File0280.txt File0364.txt File0448.txt File0532.txt File0616.txt File0700.txt File0784.txt File0868.txt File0952.txt
File0029.txt File0113.txt File0197.txt File0281.txt File0365.txt File0449.txt File0533.txt File0617.txt File0701.txt File0785.txt File0869.txt File0953.txt
File0030.txt File0114.txt File0198.txt File0282.txt File0366.txt File0450.txt File0534.txt File0618.txt File0702.txt File0786.txt File0870.txt File0954.txt
File0031.txt File0115.txt File0199.txt File0283.txt File0367.txt File0451.txt File0535.txt File0619.txt File0703.txt File0787.txt File0871.txt File0955.txt
File0032.txt File0116.txt File0200.txt File0284.txt File0368.txt File0452.txt File0536.txt File0620.txt File0704.txt File0788.txt File0872.txt File0956.txt
File0033.txt File0117.txt File0201.txt File0285.txt File0369.txt File0453.txt File0537.txt File0621.txt File0705.txt File0789.txt File0873.txt File0957.txt
File0034.txt File0118.txt File0202.txt File0286.txt File0370.txt File0454.txt File0538.txt File0622.txt File0706.txt File0790.txt File0874.txt File0958.txt
File0035.txt File0119.txt File0203.txt File0287.txt File0371.txt File0455.txt File0539.txt File0623.txt File0707.txt File0791.txt File0875.txt File0959.txt
File0036.txt File0120.txt File0204.txt File0288.txt File0372.txt File0456.txt File0540.txt File0624.txt File0708.txt File0792.txt File0876.txt File0960.txt
File0037.txt File0121.txt File0205.txt File0289.txt File0373.txt File0457.txt File0541.txt File0625.txt File0709.txt File0793.txt File0877.txt File0961.txt
File0038.txt File0122.txt File0206.txt File0290.txt File0374.txt File0458.txt File0542.txt File0626.txt File0710.txt File0794.txt File0878.txt File0962.txt
File0039.txt File0123.txt File0207.txt File0291.txt File0375.txt File0459.txt File0543.txt File0627.txt File0711.txt File0795.txt File0879.txt File0963.txt
File0040.txt File0124.txt File0208.txt File0292.txt File0376.txt File0460.txt File0544.txt File0628.txt File0712.txt File0796.txt File0880.txt File0964.txt
File0041.txt File0125.txt File0209.txt File0293.txt File0377.txt File0461.txt File0545.txt File0629.txt File0713.txt File0797.txt File0881.txt File0965.txt
File0042.txt File0126.txt File0210.txt File0294.txt File0378.txt File0462.txt File0546.txt File0630.txt File0714.txt File0798.txt File0882.txt File0966.txt
File0043.txt File0127.txt File0211.txt File0295.txt File0379.txt File0463.txt File0547.txt File0631.txt File0715.txt File0799.txt File0883.txt File0967.txt
File0044.txt File0128.txt File0212.txt File0296.txt File0380.txt File0464.txt File0548.txt File0632.txt File0716.txt File0800.txt File0884.txt File0968.txt
File0045.txt File0129.txt File0213.txt File0297.txt File0381.txt File0465.txt File0549.txt File0633.txt File0717.txt File0801.txt File0885.txt File0969.txt
File0046.txt File0130.txt File0214.txt File0298.txt File0382.txt File0466.txt File0550.txt File0634.txt File0718.txt File0802.txt File0886.txt File0970.txt
File0047.txt File0131.txt File0215.txt File0299.txt File0383.txt File0467.txt File0551.txt File0635.txt File0719.txt File0803.txt File0887.txt File0971.txt
File0048.txt File0132.txt File0216.txt File0300.txt File0384.txt File0468.txt File0552.txt File0636.txt File0720.txt File0804.txt File0888.txt File0972.txt
File0049.txt File0133.txt File0217.txt File0301.txt File0385.txt File0469.txt File0553.txt File0637.txt File0721.txt File0805.txt File0889.txt File0973.txt
File0050.txt File0134.txt File0218.txt File0302.txt File0386.txt File0470.txt File0554.txt File0638.txt File0722.txt File0806.txt File0890.txt File0974.txt
File0051.txt File0135.txt File0219.txt File0303.txt File0387.txt File0471.txt File0555.txt File0639.txt File0723.txt File0807.txt File0891.txt File0975.txt
File0052.txt File0136.txt File0220.txt File0304.txt File0388.txt File0472.txt File0556.txt File0640.txt File0724.txt File0808.txt File0892.txt File0976.txt
File0053.txt File0137.txt File0221.txt File0305.txt File0389.txt File0473.txt File0557.txt File0641.txt File0725.txt File0809.txt File0893.txt File0977.txt
File0054.txt File0138.txt File0222.txt File0306.txt File0390.txt File0474.txt File0558.txt File0642.txt File0726.txt File0810.txt File0894.txt File0978.txt
File0055.txt File0139.txt File0223.txt File0307.txt File0391.txt File0475.txt File0559.txt File0643.txt File0727.txt File0811.txt File0895.txt File0979.txt
File0056.txt File0140.txt File0224.txt File0308.txt File0392.txt File0476.txt File0560.txt File0644.txt File0728.txt File0812.txt File0896.txt File0980.txt
File0057.txt File0141.txt File0225.txt File0309.txt File0393.txt File0477.txt File0561.txt File0645.txt File0729.txt File0813.txt File0897.txt File0981.txt
File0058.txt File0142.txt File0226.txt File0310.txt File0394.txt File0478.txt File0562.txt File0646.txt File0730.txt File0814.txt File0898.txt File0982.txt
File0059.txt File0143.txt File0227.txt File0311.txt File0395.txt File0479.txt File0563.txt File0647.txt File0731.txt File0815.txt File0899.txt File0983.txt
File0060.txt File0144.txt File0228.txt File0312.txt File0396.txt File0480.txt File0564.txt File0648.txt File0732.txt File0816.txt File0900.txt File0984.txt
File0061.txt File0145.txt File0229.txt File0313.txt File0397.txt File0481.txt File0565.txt File0649.txt File0733.txt File0817.txt File0901.txt File0985.txt
File0062.txt File0146.txt File0230.txt File0314.txt File0398.txt File0482.txt File0566.txt File0650.txt File0734.txt File0818.txt File0902.txt File0986.txt
File0063.txt File0147.txt File0231.txt File0315.txt File0399.txt File0483.txt File0567.txt File0651.txt File0735.txt File0819.txt File0903.txt File0987.txt
File0064.txt File0148.txt File0232.txt File0316.txt File0400.txt File0484.txt File0568.txt File0652.txt File0736.txt File0820.txt File0904.txt File0988.txt
File0065.txt File0149.txt File0233.txt File0317.txt File0401.txt File0485.txt File0569.txt File0653.txt File0737.txt File0821.txt File0905.txt File0989.txt
File0066.txt File0150.txt File0234.txt File0318.txt File0402.txt File0486.txt File0570.txt File0654.txt File0738.txt File0822.txt File0906.txt File0990.txt
File0067.txt File0151.txt File0235.txt File0319.txt File0403.txt File0487.txt File0571.txt File0655.txt File0739.txt File0823.txt File0907.txt File0991.txt
File0068.txt File0152.txt File0236.txt File0320.txt File0404.txt File0488.txt File0572.txt File0656.txt File0740.txt File0824.txt File0908.txt File0992.txt
File0069.txt File0153.txt File0237.txt File0321.txt File0405.txt File0489.txt File0573.txt File0657.txt File0741.txt File0825.txt File0909.txt File0993.txt
File0070.txt File0154.txt File0238.txt File0322.txt File0406.txt File0490.txt File0574.txt File0658.txt File0742.txt File0826.txt File0910.txt File0994.txt
File0071.txt File0155.txt File0239.txt File0323.txt File0407.txt File0491.txt File0575.txt File0659.txt File0743.txt File0827.txt File0911.txt File0995.txt
File0072.txt File0156.txt File0240.txt File0324.txt File0408.txt File0492.txt File0576.txt File0660.txt File0744.txt File0828.txt File0912.txt File0996.txt
File0073.txt File0157.txt File0241.txt File0325.txt File0409.txt File0493.txt File0577.txt File0661.txt File0745.txt File0829.txt File0913.txt File0997.txt
File0074.txt File0158.txt File0242.txt File0326.txt File0410.txt File0494.txt File0578.txt File0662.txt File0746.txt File0830.txt File0914.txt File0998.txt
File0075.txt File0159.txt File0243.txt File0327.txt File0411.txt File0495.txt File0579.txt File0663.txt File0747.txt File0831.txt File0915.txt File0999.txt
File0076.txt File0160.txt File0244.txt File0328.txt File0412.txt File0496.txt File0580.txt File0664.txt File0748.txt File0832.txt File0916.txt File1000.txt
File0077.txt File0161.txt File0245.txt File0329.txt File0413.txt File0497.txt File0581.txt File0665.txt File0749.txt File0833.txt File0917.txt
File0078.txt File0162.txt File0246.txt File0330.txt File0414.txt File0498.txt File0582.txt File0666.txt File0750.txt File0834.txt File0918.txt
File0079.txt File0163.txt File0247.txt File0331.txt File0415.txt File0499.txt File0583.txt File0667.txt File0751.txt File0835.txt File0919.txt
File0080.txt File0164.txt File0248.txt File0332.txt File0416.txt File0500.txt File0584.txt File0668.txt File0752.txt File0836.txt File0920.txt
File0081.txt File0165.txt File0249.txt File0333.txt File0417.txt File0501.txt File0585.txt File0669.txt File0753.txt File0837.txt File0921.txt
File0082.txt File0166.txt File0250.txt File0334.txt File0418.txt File0502.txt File0586.txt File0670.txt File0754.txt File0838.txt File0922.txt
#
# cp -p /fsx/.snapshot/backup-0a6ace9bc41358822/createfiles.sh /fsx
# ls -l /fsx/createfiles*
-rwxrwxrwx. 1 root root 101 May 25 08:37 /fsx/createfiles.sh
-rw-r--r--. 1 root root 128 May 26 01:39 /fsx/createfiles.sh.cryptまとめ
CloudSecureの検知いかがだったでしょうか？
攻撃を検知して、自動でユーザアクセス制御/snapshotの取得をしてくれるなど非常に助かる機能だったかと思います。
ファイルリストアもサーバ管理者の対応なしでクライアント側から復旧できるのは楽でいいですね！
今回はLinuxの検知を試しましたが、Windowsやユーザの異常操作での検知などCloudSecureの機能を紹介しきれていないので、またブログにできたらと思います。
以上、たかやまでした。
8
