Emotet Access Protection Rule

[Zebu]

Hello,

Recently a raised number of attacks reported at my company with downloaders, most often carrying the malware Emotet.

I found the article "How to protect against Emotet" and the rules have been created.

mcafee.com/corporate/index?page=content&id=KB90108

I just wonder if it is known practice why it is not a McAfee-defined Access Protection Rule?

Thank you!

Zebu

[AdithyanT · Accepted solution]

Hi @Zebu,

Thank you for your post! Undeniably good suggestion from you. Although I would recommend raising this as a PER, I would like to point out one important point here with respect to ENS.

In KB90108, most of the rules seen are not custom made but are predefined rules. This applies to Exploit prevention rules mentioned and DAC rules mentioned. Different technologies/components are implemented to block different actions involved and hence you see the variations involved as well.

The Custom access protection rule(Rule 2) is very aggressive and targets specific variants of Emotet (launching powershell using winword.exe and cmd.exe). This however cannot be tied to emotet only!

The Rule 3 however, is too aggressive to be globally add to the list even in disabled state as it entirely blocked .exe file creation in c:\ Drive. Labeling them as specific to Emotet or any of it's variant would not really be precise (in my opinion).

Having said this, I would still suggest you to go through a PER as stated above as it would be really useful to get the Product Management's and other Enterprise user's take on this. It is very important that we have a way to update our understanding of our Customer's needs and hence we would really appreciate your input in the Enterprise Ideas forum.

*Note: Please use your Service portal login in order to access and post ideas in the ideas forum.

I sincerely hope this helps.

[Zebu]

Thank you very for the quick answer!

[AdithyanT]

Hi @Zebu,

Very glad to be of assistance! Thanks you for marking the answer and kindly letting other Community members know what helped you. Kudos to you!