Detecting Ransomware/Bot Infections in Elasticsearch
0 likes153 views
Strafer is a tool created by Dr. Aditya K Sood and Rohit Bansal to detect potential infections in Elasticsearch instances. It gathers instance information, checks for exposure online and authentication, and detects infections like ransomware, botnets, and honeypots. The open source tool is available on GitHub and aims to strengthen security efforts by sharing research with the community.
Detecting Ransomware/Bot Infections in Elasticsearch
- 1. Strafer: A Tool to Detect Infections in Elasticsearch Instances
- 2. About Tool Disclaimer https://github.com/adityaks/strafer Tool presented in this talk is for sharing research with security community to strengthen the intelligence efforts for enhancing the security of critical services on the internet. This talk does not relate to any of our previous or present employers.
- 3. About Tool Strafer Project Team https://github.com/adityaks/strafer • Dr. Aditya K Sood o Security Practitioner and Researcher o Working in the security field for more than 13 years o Regular speaker at industry leading security conferences o Author of “Targeted Cyber Attacks” Book o W: https://www.adityaksood.com o T: @adityaksood o LinkedIn: https://www.linkedin.com/adityaks • Rohit Bansal o Principal Researcher, SecNiche Security Labs o https://secniche.org/ Elasticsearch Threat Research and Intelligence Collection Elasticsearch Threat Research and Tool Development
- 4. About Tool Elasticsearch threats and attacks landscape
- 5. About Tool • Strafer: A tool to detect potential infections in Elasticsearch instances. • In this version of the tool, the following modules are supported: o Elasticsearch instance information gathering and reconnaissance (inline). o Elasticsearch instance exposure on the Internet (authentication checks). o Detecting potential ransomware infections in the Elasticsearch instances. o Detecting potential botnet infections such as meow botnet. o Detecting infected indices in the Elasticsearch instances. o Detecting Elasticsearch honeypots. Introducing Strafer
- 7. About Tool Detecting Exposed Instances
- 8. About Tool Detecting Ransomware Infections
- 9. About Tool Detecting Botnet Infections
- 10. About Tool Detecting Elasticsearch honeypots
- 11. About Tool Strafer Tool: Working
- 12. About Tool Strafer Tool: Download https://github.com/adityaks/strafer
- 13. About Tool Questions and Queries