ENS ATP

[Dwee]

Hi all,

i just want to ask why mcafee enstp and ATP only /would block and block the malwares ? (in my case its lemonduck, monero), why mcafee can't "stop" block at early stage (user action ex click attachment or links) and is "Dropper.bat" hidden/filess type of file? because from the looks of it mcafee blocking start on "powershell" stage,

at the moment we have serious issue in our DB servers, we installed atp but beside Blocking event we crosscheck with forti that sql/db server still trying to "brute force the sql server/DB server for login" and also keeps trying sending data to the outside of our area (out of country by the ip types)

in this mcafee blog : https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-amsi-integration-protects-against-malici... 

atp killchain

[yukikane]

@Dwee 
ENSTP can detect files at early stage if these are known as malicious. ATP is effective if file are NOT known as malicious. ENSTP can't detect unknown files or fileless malware, so ENS ATP monitors and blocks their behavior at later stage. Therefore, if a dropper.bat is known as malicious, ENSTP will detect it. In the case that it is unknown, ENS ATP will monitor and block it's behavior. I think the blog article explains later case.

[Dwee]

Hi, thx for your reply,

the thing is our customer doesnt case want only block, they want "clean,delete,quarantie", and also want mcafee to give some solid "white paper analysis report" about "mcafee delete / kill " lemonduck and other malware, and the funny is that in their network ther smb still open and exploited through there to get login /account admin to spread the script, can our ens tp and atp prevent that hole in their enviromnet? the support said we need to reset the ad admin password user, but that will have major impact on our dev server environment (that already compromised), do wee need to reset password first ?

regards,

Dwi

[it1024 · Accepted solution]

Hi,

In my experience relying on the Antivirus to do all the security jobs is the first mistake. When it is about SMB the operating system patches should all be installed and all the OS in the network must be up to date otherwise the Antivirus cannot do anything about it, I have seen it several times in different Antivirus software which have been totally unable to defend the vulnerable OS. Plus that resetting the admin password after being infected is one of the very first steps, so please do as Support says.

Also regarding the ATP please make sure that the Block action is selected for the rules you believe are needed to be blocked.

Good luck and please do not wait, you need to act as fast as you can!