> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/malware-propagation-prevention.md). # Malware propagation prevention **SaaS security problem** Many organizations are unfamiliar with how supply chain attacks work. Without the means to detect and stop them, supply chain attacks can have devastating consequences on corporate revenue, brand reputation, and vendor relationships. A supply chain attack is an attack strategy that targets an organization through vulnerabilities in its supply chain. These vulnerable areas are usually linked to vendors with poor security practices. Malware propagation is one of the steps in a supply chain attack. In this phase, the attacker spreads malicious code to other systems or applications via "trusted” software packages. The goal is to maximize the impact of the attack and infect as many systems or applications as possible. Once malicious code has infiltrated an organization's supply chain, attackers can exfiltrate sensitive data, launch further attacks on the target organization or its customers, or take control of the affected systems or applications. **DoControl solution** DoControl regularly monitors the supply chain for indicators of compromise. If a supply chain-based attack is identified, DoControl enables your organization to respond in time and mitigate any potential damage. The Shadow App module enables you to discover, control, and automatically remediate any potential malware propagation issues: * **Discover all connected SaaS applications to the core SaaS stack** - Identify issues of noncompliance for all connected SaaS apps in your core SaaS stack, and ensure security policies are effectively enforced. * **Expose a comprehensive inventory of 1st and 3rd party applications** - Security teams can gain a strong understanding of the riskiest SaaS apps within the SaaS estate. * **Create pre-approval policies and workflows** - Classify apps based on their risk score, and require end users to provide business justification to onboard new applications. * **Remediate suspicious apps** - Security teams can quarantine suspicious applications, reduce overly excessive permissions, remove apps, and revoke user access. DoControl leverages these tools to automatically monitor and prevent malware propagation across a variety of apps: * [Inventory](#inventory-of-malware-propagation) * [Events](#events-for-malware-propagation-prevention) * [Alerts](#alerts-for-malicious-domains) * [Playbooks](#playbooks-for-malware-propagation-prevention) * [Shadow app module](/docontrol-user-guide/saas-data-monitoring/shadow-apps.md) ## What is malware? Malware, or malicious software, is any program or file that is harmful to your organization's computer network. Types of malware include computer viruses, worms, Trojan horses, spyware, adware and ransomware. Intentionally designed to cause disruption to a computer network, malware seeks to gain unauthorized access to information, deprive access to information, and interfere with a user's computer security and privacy. Often malware will take partial control over a device's operations, or leak sensitive data such as personally identifiable information (PII) to an unauthorized third-party. ## What's the risk? The risk of malware infecting your organization's SaaS platform is a critical data breach, where sensitive information is accessed without authorization, or even worse, stolen and deleted. Data breaches can involve financial information like credit card numbers or bank account details, protected health information (PHI), personally identifiable information (PII), trade secrets or intellectual property. ## Inventory of malware propagation DoControl's rich inventory exposes Google Drive assets with malware file extensions. From the Asset page, you can search for all Google Drive assets that have a specific file extension. 1. In the Asset page, select **Google Drive** and **All Assets**. 2. For the **Filters**, define the **File extension** with the specific malware file you want to detect.
3. Click **Apply**.\ Any assets with the specified file extension are displayed. ## Events for malware propagation prevention DoControl monitors real-time events of malware propagation. In the Events page you can define a filter to display all events where endpoint malware was detected. {% hint style="warning" %} Endpoint malware events are only displayed for organizations using CrowdStrike. {% endhint %}
#### To filter for endpoint malware events: 1. In the Events page, select the **Event type** and the **CrowdStrike > Endpoint malware detection** event from the dropdown list.
2. Filter for a relevant date and click **Apply**. 3. Click the **Event JSON** link to inspect the details for a specific event. ## Alerts for malicious domains DoControl alerts automatically notify your organization when anomalous user behavior occurs. Malicious domain alerts indicate that assets were shared with or by a suspicious or malicious domain. DoControl leverages VirusTotal to determine whether a domain is malicious or not, meaning it was created for the purpose of promoting scams, phishing, spam, attacks, and frauds. Details for malicious domain alerts are displayed in the [actor or target info](/docontrol-user-guide/risk-management/alerts/view-alerts.md#malicious-domain-info), depending if the asset was shared by or with a malicious domain.

Alerts are triggered when assets are shared by or with malicious domains

If you share data with an infected URL, your organization's data could be exposed to ransomware, viruses, trojans, or other types of malware that compromise your network. To mitigate the risk of exposing your organization to malware, DoControl generates these alerts:
Alert typeDoControl alert nameAlert description
DC100Shared with malicious domainThis alert will trigger when an internal user shares an asset with a suspicious or malicious domain.
DC101Shared by malicious domainThis alert will trigger when an external user from a suspicious or malicious domain shares an asset internally or externally.
DC102Publicly shared by malicious domainThis alert will trigger when an external user from a suspicious or malicious domain shares an asset publicly.
{% hint style="info" %} For details about DoControl alerts, go to **Help > DoControl Alert Specifications**. {% endhint %} ### How to remediate alerts? If you receive malicious domain alerts, you can manually remove external sharing permissions from the exposed assets. It is also recommended to set up a workflow that will automatically remove the sharing permissions from assets that are shared with a malicious domain. ## Playbooks for malware propagation prevention To address the use cases of malware propagation across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will: * Notify your security team whenever a ransomware encryption file is uploaded to your SaaS platform. * Automatically delete malware files from Google Drive, by leveraging CrowdStrike Falcon.

Select a predefined DoControl playbook to remediate malware propagation prevention

Playbook nameSaaS appPlaybook description
Remediate malware propagation in Google DriveCrowdStrikeWhen CrowdStrike Falcon detects malware on an endpoint, the malware file is automatically deleted from Google Drive.
Notify on ransomware encryption file uploadGoogle DriveWhen someone uploads a ransomware encryption key to Google Drive, the Security team is automatically notified in Slack.
Notify on ransomware encryption file uploadOneDriveWhen someone uploads a ransomware encryption key to OneDrive, the Security team is automatically notified in Slack.
Notify on ransomware encryption file uploadSharePointWhen someone uploads a ransomware encryption key to SharePoint, the Security team is automatically notified in Slack.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/malware-propagation-prevention.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.