Improving Ransomware Detection with Breach and Attack Simulation (BAS)

Ransomware attacks are a pervasive and ongoing threat to organizations worldwide, costing billions in damages and operational downtime. For CISOs, security leaders, and SOC teams, the challenge is not just in preventing these attacks, but in detecting them as early as possible in the kill chain, before they can cause real damage.

Enter Breach and Attack Simulation (BAS), a powerful solution that enhances your organization’s ability to understand your detection capabilities and improve your security controls to mitigate ransomware threat actors before they can impact you.  

In this article, we’ll explore how BAS can significantly improve your ability to identify and prevent a ransomware threat actor by uncovering gaps in your security detections earlier in the cyber kill chain. We will also discuss common challenges in detection, the benefits of purple teaming and baselining, and how to leverage BAS effectively. 

Table of Contents

• Common Challenges in Ransomware Detection
• Improving Ransomware Detection with Purple Teaming and Baselining
• How to Use Breach and Attack Simulation for Early Ransomware Detection
• Elevating Ransomware Detection with NetSPI BAS

Common Challenges in Ransomware Detection

The Reality of Cyber Threats

The reality is that achieving 100% prevention of cyberattacks is impossible; there will always be unknown vulnerabilities and undetected misconfigurations. Secure-by-default configurations are either non-existent or impractical. If prevention is unreliable, the focus must shift to detection – ideally detection early in the kill chain.

Vendor Limitations

Relying solely on vendor-provided protection has its pitfalls. Threat actors are often able to acquire these solutions to test their malware and tactics, techniques, and procedures (TTPs), finding ways to bypass controls before performing any action in your environment. This is especially problematic if you are running with out-of-the-box configurations.  

Security vendors also are not always able to create detection logic for all cases of attacker behavior. This is because attackers often abuse some type of normal process, which if broadly signatured, would cause many false positives or potentially cause preventions and quarantines that impact a client’s production.

Resource Allocation

Determining where to allocate security resources — time and money — can be challenging. Threat hunting and detection engineering are essential to stay ahead of advanced threats, but these activities require significant investment, both in terms of time and expertise. It demands someone with deep cyber expertise, which many organizations lack, and even if they do have such expertise, it is a time-consuming process and typically involves a well-paid individual.  

NetSPI BAS addresses this by offering detailed detection and prevention guidance as well as research and threat intelligence references for your organization’s defensive personnel. This helps teams start implementing enhancements to detective controls in an informed and effective manner. 

Improving Ransomware Detection with Purple Teaming and Baselining

Understanding Detection Coverage

To understand your detection coverage, it’s crucial to collect data about what your systems observe from various threat actor activities and their TTPs. This includes information about which data sources are available for use in developing detections.  

Start with a baseline measurement of your systems, visibility, and detective controls. This baseline will help you plan, prioritize, and track improvements over time.

Ransomware Simulation versus Baselining

Ransomware simulation assesses security posture effectiveness and readiness to defend against a cyberattack. Another key step in building a robust security posture is understanding how a threat actor views your environment and how ready your organization is to defend against a potential attack.  

By emulating adversary TTPs, purple teaming exercises help security teams identify weaknesses and blind spots in their current defenses. This collaborative approach between red and blue teams ensures that detection and response strategies are collaborated over, refined, and improved. This iterative process is much quicker with live testing and feedback. 

Baselining, on the other hand, involves executing a broad variety of TTPs in your environment and compiling the results together to enable more effective improvement and identification of detective issues. Together, these practices allow organizations to focus where it counts and rapidly fine-tune their defenses, making them more robust and less predictable to the evolving modern ransomware threat.

Effectiveness of Security Controls

Data gathered through this process can reveal how effective your current detection controls are, where gaps exist, and what additional data sources, detections, or security solutions are needed.

The Role of Breach and Attack Simulation

By validating security controls with BAS, you can fine-tune your defenses, build custom controls tailored to your environment, and detect threat actors at the earliest point possible in the cyber kill chain.

The Observe, Orient, Decide, Act (OODA) Loop

Adopting the OODA loop in both attack and defense scenarios can significantly enhance your security posture. Purple team activities enable quicker iterations and immediate feedback on control efficacy, giving your blue and red teams an edge over threat actors.

How to Use Breach and Attack Simulation for Early Ransomware Detection

Shifting Left in the Cyber Kill Chain

Detecting threat actors before they fully exfiltrate data or execute a ransomware attack is the key to beating them. Remember, it’s not just about preventing the ransomware event; attackers must first gain a foothold, bypass your internal controls and escalate privileges. Catching any one single activity threat actors perform can derail their plans.

How to Shift Left with BAS

1. Baseline Assessment: Perform a comprehensive baseline assessment to identify security gaps and help prioritize the development of detection and prevention controls around the earlier phases of the cyber kill chain.
2. Identify where you can win early in the kill chain: Look through the baseline at detection misses to see what TTPs to focus on detecting.
3. Improve your detections, technology, and data sources: BAS solutions such as The NetSPI Platform can be used to track and replay these TTPs and provide research and guidance for better detections.

Elevating Ransomware Detection with NetSPI BAS

How NetSPI BAS Works

NetSPI BAS starts with a hands-on baseline assessment by our security pros, The NetSPI Agents, who will thoroughly inventory your current logging sources and detection capabilities. You’ll work with our team or use NetSPI BAS to run emulations of adversary TTPs, giving you data about your overall detection posture — data that can be used for detection creation and tuning, and opportunistically identified misconfigurations. After the engagement, your team can keep testing on NetSPI BAS even after the initial assessment is completed.

Deployment Process

Deploy the BAS agent on systems representing typical defensive configurations within your environment. If you have multiple configurations, you can deploy agents accordingly to test different setups.

Executing Tests

NetSPI BAS uses a series of automated plays that simulate threat actor behavior based on real-world TTPs. You can run plays that emulate ransomware families like CL0P, Cozy Bear (APT29), and other known threats. A key component of rapid iteration and improvement is being able to receive feedback quickly, and with NetSPI BAS you can automate tests to help strengthen your defenses.

Custom Playbooks

Create custom playbooks in NetSPI BAS using searchable MITRE TTPs. This allows you to repeatedly test and track your detective controls across various tactics in the cyber kill chain, from reconnaissance to impact. 

Remediation Tips

Each tactic is accompanied by detailed execution instructions, detection and data source recommendations, and relevant prevention considerations. This guidance helps identify previously unknown logs and detections, helps enable proper logging, and utilize tools to address issues before they escalate. 

BAS is a game-changer for organizations looking to continuously improve their ransomware detection capabilities. By identifying gaps early in the cyber kill chain, BAS empowers security teams to catch intrusions before they escalate, providing a significant advantage in the fight against ransomware.