Loading...Are you a consumer customer? Visit the Consumer Support Site |
Protecting against modified Petya and BadRabbit ransomware variants
Technical Articles ID:
KB89540
Last Modified: 9/19/2019 Rated:   Environment
McAfee products that use DATs NOTE: This article applies only to McAfee business and enterprise products. If you need information or support for McAfee consumer or small business products, visit https://service.mcafee.com. Consumer article for Petya and BadRabbit: TS102703. SummaryMcAfee is aware of modified Petya ransomware variants (also called PetrWrap, PetWrap, Petya.A, Petja, BadRabbit, and Bad Rabbit) that are being detected in corporate environments.
To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.
Solution
As a priority prevention action, update any systems with MS17-010, if they do not already contain the patch. McAfee NSP coverage for Petya Ransomware Existing signatures:
The referenced article is available only to registered ServicePortal users. To view registered articles:
Access Protection rules for VirusScan Enterprise (VSE) and Endpoint Security (ENS) The following Access Protection rules for VSE and ENS can help combat the malware. McAfee has updated the recommended AP rules to more effectively target this specific variant of Petya. NOTE: These Access Protection rules do not circumvent the need to implement the Extra.DAT. They are intended to assist in combating the malware, but will not prevent the malware payload from being created or executed on a system. These two Access Protection rules will prevent rundll32.exe from starting any instances of cmd.exe, and will also prevent creation of Microsoft Technet’s PSExec utility. These will not prevent downloading and/or saving of the original file name for PSExec, so an administrator can still make use of this utility as needed. VSE Access Protection Rules Process to include: rundll32.exe Process to exclude: File/Folder to block: cmd.exe Actions: Block execution NOTE: This will prevent the process named rundll32.exe from executing any instances of cmd.exe, found to be a core behavior of the Malware. This includes any legitimate software that might perform the same behavior, with custom scripting as an example. Process to include: * Process to exclude: File/Folder to block: **\PSEXESVC.EXE Actions: Block creation NOTE: This will prevent any process from creating PSExec's remote service. Preventing this file creation can assist with preventing the replication of PSExec, a component used in replication of the malware payload. This will not prevent an administrator from saving any new copies of PSExec to systems where this rule is applied, but it will prevent PSEXESVC.EXE from being created on the target system, thus preventing the use of PSExec - whether it is used maliciously or for normal remote administrative purposes. ENS Access Protection Rules Create a new rule with an inclusion status of "Include" using rundll32.exe for the File name or Path Create a sub-rule with a type of "files," and for a target include cmd.exe Select the action to prevent execution Create a new rule with an inclusion status of "Include" using * for the File name or Path Create a sub-rule with a type of "files," and for a target include **\PSEXESVC.EXE Select the action to prevent creation Related Information
Additional Resources: Microsoft Security Bulletin MS17-010 – Critical: https://technet.microsoft.com/library/security/MS17-010 KB70130 - How to enable Global Threat Intelligence Technology in various products KB91934 - Protecting Against Ransomware KB50642 - How to apply an Extra.DAT locally for VirusScan Enterprise 8.x KB67602 - How to manually check in and deploy an Extra.DAT through ePolicy Orchestrator KB59410 - How to determine which computers have an Extra.DAT installed via ePO reporting PD26799 - Endpoint Security 10.5 Product Guide (For Extra.DAT check-in steps, see pages 28 and 29.) AttachmentAffected ProductsLanguages:This article is available in the following languages: GermanEnglish United States Spanish Spain French Italian Japanese Korean Dutch Portuguese Brasileiro Chinese Simplified Chinese Traditional Glossary of Technical Terms |
Copyright © McAfee LLC
|
Question?
.png)
