Behavior:Win32/Ransomware!Play.A

Guidance for individual users

Keep your operating system and antivirus products up to date.

Take these steps to help prevent malware infection on your computer.

Guidance for enterprise administrators

Following the mitigation steps below can help prevent malware attacks:

• Harden internet-facing assets and ensure they have the latest security updates. Use threat and vulnerability management to audit these assets regularly for vulnerabilities, misconfigurations, and suspicious activity.
• Turn on cloud-delivered protection and automatic sample submission on Microsoft Defender Antivirus. These capabilities use artificial intelligence and machine learning to quickly identify and stop new and unknown threats.
• Secure Remote Desktop Protocol (RDP) or Windows Virtual Desktop endpoints with multifactor authentication (MFA) to harden against password spray or brute force attacks. If you don't have an MFA gateway, enable network-level authentication (NLA) and ensure that server machines have strong, randomized local admin passwords.
• Turn on attack surface reduction rules, including rules that block credential theft, ransomware activity, and suspicious use of PsExec and WMI. To address malicious activity initiated through weaponized Office documents, use rules that block advanced macro activity, executable content, process creation, and process injection initiated by Office applications. To assess the impact of these rules, deploy them in audit mode.
• Turn on tamper protection features to prevent attackers from stopping security services.