cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 1 of 4

New ZLoader Maldoc Detection

Seems some changes in Zloader.  It executes via WMI and has new sandbox evasions. If you aren't currently able to block Office accessing WMI, the following Expert Rule will block the new variant.  This is based upon MD5: f567b6c855c603df4fc914ce307de065.

Rule {
Process {
Include OBJECT_NAME { -v "wmiprvse.exe" }
}
Target {
Match PROCESS {
Include OBJECT_NAME { -v "certutil.exe" }
Include PROCESS_CMD_LINE { -v "*decode*" }
Include -access "CREATE"
}
}
}

This rule requires ENS 10.7.  10.6 would need a rewrite.  

3 Replies
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: New ZLoader Maldoc Detection

Hello , 

Expert Rules are supported by McAfee professional Services and its a paid service. Kindly reach out to your respective Support Account Manager and they will direct you to Professional services for any assistance on the same .

 

Thank you 

Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 4

Re: New ZLoader Maldoc Detection

Thanks.   Wasn't really asking for help though.   🙂

Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 4

Re: New ZLoader Maldoc Detection

@mcafeeSupport USA

Simply all covid 19 thinking delay now?

Maybe it's time to come down from the high horse now and look what your customers and partners do here on daily basis for your company instead of pushing through quartal sales.

He shared the EXPERT rule to public so others can profit. Instead of answering that the DAT/AMCORE from this evening will reflect the change and thank him you mention professionell services.

by the way we lost a key account customer project to RAPID7 of around USD 200'000.- this year because mcafee was unable to support Professionell Services 24/7 in Switzerland.

Greetins from a Mcafee Partner

 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community