cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

ENS unable to detect threats running on the Ransomware Simulator

Jump to solution

Hi,

Need help on creating strong ENS Threat Prevention & ATP policy against simulated threats from KnowBe4 ransomware simulator. The attached result is the output we got from Simulator tool against the existing ENS policies. 

Note: ENS ATP Rule group at Balance mode

 

McAfee Endpoint Security 

 

 

1 Solution

Accepted Solutions
Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 8

Re: ENS unable to detect threats running on the Ransomware Simulator

Jump to solution

So not trying to spam, but turning off OAS and changing some reputations in TIE, I was able to get it to run.  Using DAC as I defined above, I was able to get 0/19 vulnerable.  19/19  not vulnerable and 2 incorrectly blocked.  I suspect the latter two are just because I need to trust something that isn't trusted in TIE, which isn't hard, but didn't spend the time to figure it out.

Dave

View solution in original post

7 Replies
Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 8

Re: ENS unable to detect threats running on the Ransomware Simulator

Jump to solution

If you have TIE, your best bet for this is to use DAC in ATP and contain at Unknown.  Set the memory injection rules to block and the deleting/modifying files associated with ransomware to block.  This should generally protect you.  

Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 8

Re: ENS unable to detect threats running on the Ransomware Simulator

Jump to solution

Actually, I just tried it myself.  How did you even get it working?  Two of the files were getting killed at execution for me, so it won't even run by default. 

Dave

Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 8

Re: ENS unable to detect threats running on the Ransomware Simulator

Jump to solution

So not trying to spam, but turning off OAS and changing some reputations in TIE, I was able to get it to run.  Using DAC as I defined above, I was able to get 0/19 vulnerable.  19/19  not vulnerable and 2 incorrectly blocked.  I suspect the latter two are just because I need to trust something that isn't trusted in TIE, which isn't hard, but didn't spend the time to figure it out.

Dave

View solution in original post

Highlighted

Re: ENS unable to detect threats running on the Ransomware Simulator

Jump to solution

Hi @Daveb3d,

For me also got  two events blocked by ENS, Could I have the policy exported please to test it out.

Highlighted

Re: ENS unable to detect threats running on the Ransomware Simulator

Jump to solution

Hi @Daveb3d,

Appreciate your cooperation on this. I also able to get 0/19 vulnerable by changing the DAC rule. Can you please explain more about Memory Injection rule thing further

Thanks

Dilan

Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 7 of 8

Re: ENS unable to detect threats running on the Ransomware Simulator

Jump to solution

In short, there are different techniques to write in the memory of another process.  This allows bad code to run in what is otherwise a good process, and so you make that good process do bad things.  The memory rules block the access requests to access into memory in various ways, such as PROCESS_VM_WRITE and SET_THREAD_CONTEXT.  This is a pretty common attack technique, so these rules just shut that down.

Dave

Highlighted

Re: ENS unable to detect threats running on the Ransomware Simulator

Jump to solution

Hi @Daveb3d,

Thanks for the explanation of those rules. I sorted out some areas in ENS policies.  

Thanks

Dilan

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community