cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
sw41
Level 10
Report Inappropriate Content
Message 1 of 3

Fireeye IOC to add to ENS

In light of the Fireeye breach, we have some Network IOC and SHA256 hashes we want to watch for with ENS but I am not figuring out how to do that with ENS.  One article talked about a hunt table, can't find how to make that in EPO.  Another one pointed to Policy > ENS Threat Prevention > Access protection but it wants MD5 hashes and not SHA256.  Can someone point me to the KB on how to add these to EPO??

2 Replies
Pravas
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Fireeye IOC to add to ENS

Hi @sw41 

You can use McAfee ENS Access Protection feature to block processes using MD5.

Its best to create a ticket with McAfee and share the list of IOCs along with its reference URL/Blog/Advisory.

We can confirm with labs if they are already covered.

Meanwhile, if you're looking for instructions on blocking MD5 Processes, please find attached Doc file for your reference.

Thanks

jsam
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Fireeye IOC to add to ENS

Please review MVISION Insights: FireEye Red Team Tools Stolen In Cyber Attack Technical Articles ID: KB93880

Section at foot of KB 

Endpoint Security - Access Protection Custom Rules:
 

Rule: 1
Executables (Include):
winword.exe
Subrules:
Subrule Type: Files
Operations:
create
Targets (Include):
?:\programdata\*\*.exe

Rule: 2
Executables (Include):
winword.exe
Subrules:
Subrule Type: Files
Operations:
create
Targets (Include):
?:\programdata\*\*.zip
 
*** Always test new rules in a controlled environment before widespread deployment ***
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community