Firewall Best Practices to Block Ransomware Attacks

By /

Listen to this Post

Featured Image

Introduction:

Ransomware attacks continue to evolve, targeting organizations of all sizes. Firewalls serve as a critical first line of defense when configured correctly. This article explores firewall best practices, command-level configurations, and mitigation techniques to prevent ransomware infiltration.

Learning Objectives:

  • Understand firewall rules to block ransomware command-and-control (C2) traffic.
  • Implement intrusion prevention system (IPS) signatures for ransomware detection.
  • Harden cloud and on-premise firewall policies against exploit attempts.

1. Blocking Ransomware C2 Traffic with Firewall Rules

Command (Linux – `iptables`):

sudo iptables -A INPUT -p tcp --dport 443 -m string --string "ransomware_c2_domain" --algo bm -j DROP

What This Does:

This `iptables` rule blocks HTTPS traffic (port 443) containing a known ransomware C2 domain string.

Steps to Apply:

  1. Identify ransomware C2 domains from threat intelligence feeds.

2. Replace `”ransomware_c2_domain”` with the actual domain.

3. Apply the rule persistently using `iptables-save`.

2. Enabling IPS Signatures for Ransomware Detection

Command (Suricata – Snort Rule):

alert tcp any any -> any any (msg:"Ransomware C2 Beacon"; content:"|00 01 86 A5|"; sid:1000001; rev:1;)

What This Does:

This Suricata/Snort rule detects a ransomware beacon pattern in network traffic.

Steps to Apply:

1. Add the rule to `/etc/suricata/rules/local.rules`.

2. Reload Suricata:

sudo systemctl restart suricata

3. Hardening Windows Firewall Against Ransomware

Command (Windows – PowerShell):

New-NetFirewallRule -DisplayName "Block Ransomware Ports" -Direction Inbound -LocalPort 445,3389 -Protocol TCP -Action Block

What This Does:

Blocks inbound SMB (445) and RDP (3389) traffic, common ransomware entry points.

Steps to Apply:

1. Run PowerShell as Administrator.

2. Execute the command and verify with `Get-NetFirewallRule`.

4. Cloud Firewall Hardening (AWS Security Group)

Command (AWS CLI):

aws ec2 authorize-security-group-ingress --group-id sg-123456 --protocol tcp --port 22 --cidr 10.0.0.0/24 --no-authorized-ips

What This Does:

Restricts SSH access (port 22) to a specific IP range, reducing exposure to brute-force attacks.

Steps to Apply:

1. Replace `sg-123456` with your security group ID.

  1. Adjust the CIDR block (10.0.0.0/24) to your trusted network.

5. Detecting Ransomware with YARA Rules

Command (YARA Rule):

rule Ransomware_Indicator { 
strings: 
$crypt_string = "encrypt" nocase 
$ransom_note = "READ_ME.txt" 
condition: 
any of them 
}

What This Does:

Scans files for ransomware-related strings (e.g., “encrypt” or ransom notes).

Steps to Apply:

1. Save the rule to `ransomware.yar`.

2. Scan files:

yara ransomware.yar /path/to/scan

6. Blocking Malicious IPs via Firewall

Command (Linux – `nftables`):

sudo nft add table ip filter 
sudo nft add chain ip filter input { type filter hook input priority 0 \; } 
sudo nft add rule ip filter input ip saddr { 1.2.3.4, 5.6.7.8 } drop

What This Does:

Drops traffic from known malicious IPs.

Steps to Apply:

1. Replace `1.2.3.4, 5.6.7.8` with threat intelligence-sourced IPs.

  1. Persist rules with nft list ruleset > /etc/nftables.conf.

7. Disabling SMBv1 to Prevent Ransomware Spread

Command (Windows – Registry):

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "SMB1" -Value 0

What This Does:

Disables SMBv1, a protocol exploited by ransomware like WannaCry.

Steps to Apply:

1. Reboot after execution.

2. Verify with `Get-SmbServerConfiguration | Select EnableSMB1Protocol`.

What Undercode Say:

  • Key Takeaway 1: Firewalls are only effective when paired with updated threat intelligence and layered security controls.
  • Key Takeaway 2: Automated blocking of C2 traffic and suspicious ports reduces ransomware success rates.

Analysis:

Ransomware actors increasingly exploit misconfigured firewalls and legacy protocols. Organizations must adopt a zero-trust approach, combining firewall rules, IPS, and endpoint detection. The future of ransomware defense lies in AI-driven anomaly detection, but proactive hardening remains critical.

Prediction:

By 2025, ransomware will increasingly target cloud workloads, necessitating adaptive firewall policies and real-time threat intelligence integration. Organizations that fail to automate defenses will face higher breach costs.

IT/Security Reporter URL:

Reported By: Activity 7339136459850866689 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: