Skip to main content
Customer Support Customer Support
Solved

Knowbe4 RanSim Ransomware Simulator

  • October 27, 2016
  • 4 replies
  • 132 views
L
Fresh Face
I recently discovered this ransomware simulator test from KnowBe4: https://www.knowbe4.com/ransomware-simulator
Actually found this on Spiceworks: https://community.spiceworks.com/topic/1874415-ransomware-simulator-we-failed
It simulates 5 different types of ransomware, and allows you to see if your security solution will protect you from it.
 
I had a new laptop that I had just provisioned for a user (I am an MSP), and after I installed Webroot SecureAnywhere Endpoint (Business), I decided to test how Webroot would fair. I am dissapoiinted to say that accoding to the results it failed 5 out of 5.  Webroot did quarantine the installation package when I attempted to copy it over to the laptop, but after recovering it from quarantine I was able to install it and run the simulator. One person in the Spicework community post stated that he had Webroot and it detected all 5 and was not vulnerable. I did not get the same results. My policy is pretty much the default settings from the Global Recommended Defaults policy.
 
I was wondering if anyone else has tested this and also if maybe Webroot support has more information to share. I would definitely like to see Webroot handling this test better. 
 
A screenshot of the results::
?
 
Thanks
LThibx

Best answer by coscooper

@ - I would highly recommend copying the default policy and change the PUA setting to on, especially when you're testing. All of us who work with customers always recommend as best practice to create a copy and use the defaults as templates and NOT assign them to any working endpoint. Change PUAs and you'll be better protected.
 
Policy -> Scan Settings -> (Scroll to the bottom)-> PUA - turn to on. (It's off by default).
 
HTH
~Shane
View original
    Did this help you find an answer to your question?

    FredFunk
    Forum|alt.badge.img+10
    • FredFunkOpenText Employee
    • Sr. Threat Research Analyst
    • November 16, 2016
    Hi LThibx!
     
    Apologis for the delay. We have re-ran this test and we now score a perfect score. I'm not sure quite what has happened in the interim but perhaps your test might have been using an incorrect policy? If you re-run this test with the default policy and you still get bad results perhaps this could hint to installation or comms issues so please contact our support.
     
    Thanks
     
     
    Further questions or tips? I'm @threatmurray or kmurray@webroot.com
    akim
    RetiredTripleHelix
    B
    3 people like this
    • akim
      akim
    • RetiredTripleHelix
      RetiredTripleHelix
    • B
      BurnDaddy
    coscooper
    Forum|alt.badge.img+26
    • coscooper
    • Manager, Channel Sales
    • November 16, 2016
    @ - I would highly recommend copying the default policy and change the PUA setting to on, especially when you're testing. All of us who work with customers always recommend as best practice to create a copy and use the defaults as templates and NOT assign them to any working endpoint. Change PUAs and you'll be better protected.
     
    Policy -> Scan Settings -> (Scroll to the bottom)-> PUA - turn to on. (It's off by default).
     
    HTH
    ~Shane
    Shane Cooper | Manager, Channels Sales (RMM & Strategic Partners)
    akim
    RetiredTripleHelix
    L
    3 people like this
    • akim
      akim
    • RetiredTripleHelix
      RetiredTripleHelix
    • L
      LThibx
    L
    Fresh Face
    • LThibx
    • Fresh Face
    • November 22, 2016
    @, @,
     
    Thanks to both of you for leading me in the right direction. 
    • First, I always make copies of the default policies and make my changes to those copies. Never change the defaults.
    • Second, Yes I had to turn the detection of PUAs in my policies Scan Settings. Once I enabled this detection the RanSim ran as expected:


     
    I have now changed my policies at the global level, so now I feel a bit more confortable about the protection of all endpoints across my client base. 
     
    Thanks again!
    LThibx
    RetiredTripleHelix
    1 person likes this
    • RetiredTripleHelix
      RetiredTripleHelix
    coscooper
    Forum|alt.badge.img+26
    • coscooper
    • Manager, Channel Sales
    • November 22, 2016
    @ - no problem, glad we could assist. I also went and grabbed the RanSim files after your post and tested them against several of our internal test VMs with 100% success. (PUAs on of course. 😎
    Shane Cooper | Manager, Channels Sales (RMM & Strategic Partners)
    RetiredTripleHelix
    1 person likes this
    • RetiredTripleHelix
      RetiredTripleHelix

    Reply


    Terms & Conditions