<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-endpoint-ransomware-protection
description: >-
  Implement endpoint-level ransomware protection controls including EDR
  configuration, controlled folder access, application allowlisting,
  exploit guard settings, AMSI integration, and behavior-based detection
  tuning. Covers CrowdStrike, Microsoft Defender, and SentinelOne
  configurations for maximum ransomware protection.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - endpoint-protection
  - edr
  - controlled-folder-access
  - application-allowlisting
  - exploit-guard
  - amsi
  - crowdstrike
  - defender
  - sentinelone
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1486"]
---

# Implementing Endpoint Ransomware Protection

## Overview

Endpoint protection is the last line of defense before ransomware encrypts
files. Properly configured EDR with behavioral detection, controlled folder
access, and application allowlisting can stop ransomware even when initial
access succeeds. The key is defense in depth — no single control is sufficient.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Microsoft Defender | Built-in endpoint protection | Windows built-in |
| CrowdStrike Falcon | Enterprise EDR | Agent deployment |
| SentinelOne | AI-based EDR | Agent deployment |
| AppLocker | Application allowlisting | Windows GPO |
| WDAC | Code integrity | Windows 10+ |

## Key Concepts

### Endpoint Protection Stack

```
Layer 1: Application Allowlisting (prevent unknown execution)
├── AppLocker / WDAC — block unauthorized executables
├── Software Restriction Policies — legacy fallback
└── Critical for servers — only allow known software

Layer 2: Exploit Protection (prevent exploitation)
├── ASLR, DEP, CFG — memory protections
├── Attack Surface Reduction rules — Office macro blocking
└── Network protection — block malicious URLs

Layer 3: Behavioral Detection (detect ransomware behavior)
├── EDR behavioral analysis — mass file rename detection
├── Anti-tampering — protect EDR from being disabled
└── Memory scanning — detect in-memory ransomware

Layer 4: Controlled Folder Access (protect files)
├── Windows Controlled Folder Access
├── Protected folders: Documents, Desktop, etc.
└── Only approved apps can modify protected files
```

### Attack Surface Reduction Rules

| Rule | GUID | Protection |
|------|------|-----------|
| Block Office macros from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A | High |
| Block executable content from email | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 | High |
| Block credential stealing from LSASS | 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 | Critical |
| Block process creations from PSExec/WMI | D1E49AAC-8F56-4280-B9BA-993A6D77406C | High |
| Block untrusted/unsigned processes from USB | B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4 | Medium |

## Workflow

### Step 1 — Configure Controlled Folder Access

```powershell
# Enable Controlled Folder Access
Set-MpPreference -EnableControlledFolderAccess Enabled

# Add protected folders
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Data"
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Shares"
Add-MpPreference -ControlledFolderAccessProtectedFolders "E:\Backups"

# Allow specific applications through CFA
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\Veeam\*"
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\Microsoft Office\*"

# Verify configuration
Get-MpPreference | Select-Object EnableControlledFolderAccess,
  ControlledFolderAccessProtectedFolders,
  ControlledFolderAccessAllowedApplications
```

### Step 2 — Enable Attack Surface Reduction Rules

```powershell
# Enable all ransomware-relevant ASR rules in Block mode
$asrRules = @{
    # Block Office macros from creating child processes
    "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" = 1
    # Block executable content from email
    "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550" = 1
    # Block credential stealing from LSASS
    "9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2" = 1
    # Block process creations from PsExec/WMI
    "D1E49AAC-8F56-4280-B9BA-993A6D77406C" = 1
    # Block ransomware (advanced protection)
    "C1DB55AB-C21A-4637-BB3F-A12568109D35" = 1
    # Block untrusted processes from USB
    "B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4" = 1
}

foreach ($rule in $asrRules.GetEnumerator()) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $rule.Key `
      -AttackSurfaceReductionRules_Actions $rule.Value
}

# Verify ASR rules
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
```

### Step 3 — Configure AppLocker Policies

```powershell
# Create AppLocker policy for servers (strict allowlisting)
# Allow only signed executables from trusted publishers

# Export default rules as baseline
Get-AppLockerPolicy -Effective -Xml > C:\Policies\baseline.xml

# Key AppLocker rules for ransomware prevention:
# 1. Block executables in user-writable paths
# 2. Block scripts (PS1, VBS, JS) except approved
# 3. Block DLLs from temp directories
# 4. Allow only signed executables on servers

# Apply via GPO: Computer Configuration > Windows Settings >
# Security Settings > Application Control Policies > AppLocker
```

### Step 4 — CrowdStrike Falcon Configuration

```bash
# Enable maximum prevention policies
# Falcon Console > Configuration > Prevention Policies

# Critical settings for ransomware:
# - Ransomware: ON (Block + Kill)
# - Suspicious Processes: ON
# - Intelligence-Sourced Threats: ON
# - Sensor Anti-Tamper: ON
# - Script-Based Execution Monitoring: ON
# - Suspicious Registry Operations: ON

# Enable IOA (Indicator of Attack) rules
# - Volume Shadow Copy Deletion: Block
# - Credential Dumping: Block
# - Lateral Movement: Alert + Block

# API: Verify prevention policy
curl -s "https://api.crowdstrike.com/policy/queries/prevention/v1" \
  -H "Authorization: Bearer $CS_TOKEN" | jq '.resources'
```

### Step 5 — Enable Tamper Protection

```powershell
# Microsoft Defender tamper protection (prevents EDR disable)
# Must be enabled via Microsoft Endpoint Manager / Intune
# Cannot be enabled locally (by design — prevents attacker disabling)

# Verify tamper protection status
Get-MpComputerStatus | Select-Object IsTamperProtected

# CrowdStrike anti-tamper
# Enabled via prevention policy — "Sensor Anti-Tamper Protection"
# Requires uninstall token to remove agent

# SentinelOne anti-tamper
# Console > Sentinels > Policy > Anti-Tamper = Enabled
```

### Step 6 — Linux Endpoint Hardening

```bash
# SELinux enforcing mode
setenforce 1
sed -i 's/SELINUX=permissive/SELINUX=enforcing/' /etc/selinux/config

# Restrict execution from /tmp and /dev/shm
# /etc/fstab additions:
# tmpfs /tmp tmpfs defaults,noexec,nosuid,nodev 0 0
# tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0
mount -o remount,noexec /tmp
mount -o remount,noexec /dev/shm

# Install and configure ClamAV on-access scanning
apt install clamav-daemon
cat >> /etc/clamav/clamd.conf <<EOF
OnAccessMountPath /home
OnAccessMountPath /data
OnAccessPrevention yes
OnAccessExcludeUname clamav
EOF
systemctl restart clamav-daemon
```

## Detection

```yaml
title: Endpoint Ransomware Protection Detection
id: 385c5dd5-e352-4f03-b843-0a9332442fdc
status: experimental
description: Detects suspicious activity related to implementing endpoint ransomware protection techniques in ransomware defense context
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: critical
tags:
  - attack.t1486
  - attack.impact
falsepositives:
  - Backup software performing scheduled file encryption operations
```

## Verification

- [ ] Controlled Folder Access enabled on all endpoints
- [ ] ASR rules in Block mode (not Audit) for critical rules
- [ ] AppLocker/WDAC enforcing on servers
- [ ] EDR anti-tamper protection enabled
- [ ] Ransomware-specific behavioral detection enabled
- [ ] LSASS credential guard or ASR rule active
- [ ] Linux endpoints hardened (noexec /tmp, SELinux)

## References

- Microsoft ASR Rules: https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference
- CIS Benchmark: Windows Server/Desktop
- MITRE ATT&CK T1486: Data Encrypted for Impact
- NIST SP 800-123: Guide to General Server Security
