How to protect against Emotet

Technical Articles ID: KB90108
Last Modified: 5/16/2022

Environment

All products that use DATs

NOTE: This article applies only to McAfee Enterprise products. If you need information or support for McAfee consumer or small business products, go to McAfee Customer Service.

Summary

We're aware of new variants of Emotet detected in corporate environments. Threat Name: Emotet-FEJ

Read the official Threat Advisory in KB91854 - Threat Advisory: Emotet.

Minimum DATs for coverage:

VirusScan Enterprise (VSE) 8736 or higher *
Endpoint Security (ENS) 3187 or higher *

* McAfee-defined content protection against known variants.

As a best practice, configure repository update tasks with a minimal refresh interval. This configuration makes sure that new content is applied when we release it.

IMPORTANT: Before you implement the following recommendations, you must thoroughly test the rules to check their integrity. You must also make sure that no legitimate application (developed in-house or otherwise) is deemed malicious and prevented from functioning in your production environment. You can set the rules suggested below in "report-only" mode for testing purposes to verify that they cause no conflict in your environment. When you determine that these rules don't block any activity from legitimate applications, set the rules to block and apply these settings to all relevant systems.

VSE and ENS Access Protection Proactive Measures
For reference purposes, see the following KB articles to configure Access Protection Rules in VSE and ENS:

Use VSE Access Protection rules:

Rule1:

Rule: Common Maximum Protection - Prevent creation of new executable files in the Windows folder
Rule Category: Downloader/Payload/Isolation
Rule Aggression: Aggressive

Rule2:

Rule Type: File/Folder Blocking Rule
Process to include: winword.exe
File or folder name to block: cmd.exe
File actions to prevent: Files being executed
Rule Category: Downloader
Rule Aggression: Mildly Aggressive
Screenshot of rule to block cmd.exe through winword.exe

Screenshot of rule to block cmd.exe through winword.exe

Rule3:

Rule Type: File/Folder Blocking Rule
Process to include: winword.exe
File or folder name to block: powershell.exe
File actions to prevent: Files being executed
Rule Category: Downloader
Rule Aggression: Mildly Aggressive
Screenshot of rule to block powershell.exe through winword.exe

Screenshot of rule to block powershell.exe through winword.exe

Rule4:

Rule Type: File/Folder Blocking Rule
Process to include: *
File or folder name to block: C:\*.exe
File actions to prevent: New files being created
Rule Category: Isolation
Rule Aggression: Aggressive
$Screenshot of rule to block C:\*.exe$

Use ENS Access Protection rules:

Rule1:

Rule Name: Creating new executable files in the Windows folder
Rule Category: Downloader/Payload/Isolation
Rule Aggression: Aggressive
Screenshot of enabling the rule 'Creating new executable files in the Windows folder'

Screenshot of enabling the rule 'Creating new executable files in the Windows folder'

Rule2:

Executable1:

Inclusion: Include
File Name or Path: winword.exe
Screenshot of rule to block winword.exe

SubRule1:

SubRule Type: Files
Operations: Execute

Target1:

Inclusion: Include File, folder name, or file path 1: cmd.exe
File, folder name, or file path 2: powershell.exe
Rule Category: Downloader
Rule Aggression: Mildly Aggressive
Screenshot of rule to block cmd.exe and powershell.exe

Screenshot of rule to block cmd.exe and powershell.exe

Rule3:

Executable1:

Inclusion: Include
File Name or Path: *
Screenshot of rule to block all processes

SubRule1:

SubRule Type: Files
Operations: Create

Target1:

Inclusion: Include
File, folder name, or file path: C:\*.exe
Rule Category: Isolation
Rule Aggression: Aggressive
$Screenshot of rule to block C:\*.exe$

Use ENS Exploit Prevention rules:

Rule1:

Rule ID: 6087
Rule Name: PowerShell Command Restriction – EncodedCommand
Rule Category: Downloader
Rule Aggression: Aggressive

Host Intrusion Prevention (Host IPS) Proactive Measures
This section provides additional information about observed Host IPS rules triggered by known Emotet variants.

Use of Host IPS rules:

Rule1:

Rule ID: 6010
Rule Name: Generic Application Hooking Protection
Rule Category: Downloader/Payload
Rule Aggression: Aggressive

Rule2:

Rule ID: 6011 Rule Name: Generic Application Invocation Protection
Rule Category: Downloader/Payload
Rule Aggression: Aggressive

Rule3:

Rule ID: 6087
Rule Name: PowerShell Command Restriction – EncodedCommand
Rule Category: Downloader
Rule Aggression: Aggressive

Rule4:

Rule ID: 1148
Rule Name: CMD Tool Access by a Network Aware Application
Rule Category: Downloader
Rule Aggression: Aggressive

ENS with Adaptive Threat Protection (ATP) – Real Protect and Dynamic Application Containment (DAC)
ENS with ATP Real Protect, with DAC, provides next-generation protection against unknown exploits.

ENS with ATP provides full protection against all known variants of the Emotet. We recommend the following ATP configuration for detection of unknown Emotet variants:

Configure the following setting in the Adaptive Threat Protection - Options Policy:

Rule Assignment = Security (default setting is Balanced)
Configure the following rules in the ATP – DAC policy:

DAC – Containment Rules

See KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules. Set the recommended DAC rules to Block as prescribed.

ENS DAC rules triggered by Emotet variants
This section provides additional information about observed DAC rules triggered by known Emotet variants. More rule enablement might not be needed to effectively contain related processes not detected by other layers of the ENS security stack.

See KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules. Set the recommended DAC rules to Block as prescribed:

Rule1:

Rule Name: Modifying the hidden attribute bit
Rule Category: Payload
Rule Aggression: Cautious

Rule2:

Rule Name: Executing any child process
Rule Category: Payload Rule
Aggression: Mildly Aggressive

Rule3:

Rule Name: Modifying the Services registry location
Rule Category: Payload
Rule Aggression: Mildly Aggressive

Rule4:

Rule Name: Modifying portable executable files
Rule Category: Payload
Rule Aggression: Mildly Aggressive

Rule5:

Rule Name: Creating files with the .exe extension
Rule Category: Payload
Rule Aggression: Aggressive

Affected Products

Advanced Threat Defense 4.8.x
Advanced Threat Defense 4.6.x (EOL)
Advanced Threat Defense 4.4.x (EOL)
Advanced Threat Defense 4.2.x
Configuration
Endpoint Security Adaptive Threat Protection
Endpoint Security for Linux Threat Prevention 10.x
Endpoint Security for Mac Threat Prevention 10.x
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
MOVE Antivirus Multi-platform 4.8.x
MOVE Antivirus Multi-platform 4.7.x
MOVE Antivirus Multi-platform 4.6.x (EOL)
Security for SharePoint (PortalShield) 3.5
SuperDAT Manager 2.x
Threat Prevention and Removal
VirusScan Command Line Scanner 6.1.x (EOL)
VirusScan Enterprise 8.8 (EOL)
VirusScan Enterprise for Linux 1.9.x (EOL)
VirusScan Enterprise for Linux 2.0.x (EOL)
VirusScan Enterprise for Storage 1.3.x
VirusScan Enterprise for Storage 1.2.x
VirusScan for Mac 9.6 (EOL)
VirusScan for Mac 9.7 (EOL)
VirusScan for Mac 9.8 (EOL)
Web Gateway 9.2.x
Web Gateway 9.1.x
Web Gateway 9.0.x
Web Gateway 8.2.x
Web Gateway 8.1.x (EOL)
Web Gateway 8.0.x (EOL)
Web Gateway 7.8

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

How to protect against Emotet

Environment

Summary

Affected Products

Languages:

Title

Title

Knowledge Center

How to protect against Emotet

Environment

Summary

Affected Products

Languages:

Choose your region

Title

Title