Section 5.5: Defensive Countermeasures

Question 1

How can I increase the space to store more snapshots?

Answer 1

Use the vssadmin.exe tool and resize the amount of space.

Question 2

What can I do to create more snapshots?

Answer 2

Use scheduled tasks to make more. Weekly would be preferred.

Question 3

Which executables should be monitored for suspicious activity? Why are they important?

Answer 3

fsutil, vssadmin, wmic shadowcopy, & win32_shadowcopy. These tools can be used to change the size of journals or VSS files as well as delete them.

Question 4

How can I resize the USNJournal? What is a good size for a Windows server?

Answer 4

Use “fsutil usn queryjournal <volumne>". A good size would be around 256 MB. That can last about a week.</volumne>

Question 5

Best way to maintain visibility?

Answer 5

Log everything and forward it to a secure server. It is also important to setup a hearbeat monitor to check for absence of forwarding events within a certain timeframe.