How to protect against Emotet

Technical Articles ID: KB90108
Last Modified: 9/15/2020

Environment

All McAfee products that use DATs

NOTE: This article applies only to McAfee business and enterprise products. If you need information or support for McAfee consumer or small business products, visit https://service.mcafee.com.

Summary

McAfee is aware of new variants of Emotet detected in corporate environments. Threat Name: Emotet-FEJ

Read the McAfee official Threat Advisory here: KB91854.

Minimum DATs for coverage:

VirusScan Enterprise (VSE) 8736 or higher *
Endpoint Security (ENS) 3187 or higher *

* McAfee-defined content protection against known variants.

As a best practice, configure repository update tasks with a minimal refresh interval. This configuration makes sure that new content is applied when McAfee releases it.

IMPORTANT: Before you implement the following recommendations, you must thoroughly test the rules to ensure their integrity. You must also make sure that no legitimate application (developed in-house or otherwise) is deemed malicious and prevented from functioning in your production environment. You can set the rules suggested below in "report-only" mode for testing purposes to verify that they cause no conflict in your environment. When you determine these rules do not block any activity from legitimate applications, set the rules to block and apply these settings to all relevant systems.

VirusScan Enterprise (VSE) and Endpoint Security (ENS) Access Protection Proactive Measures
For reference purposes, see the following KB articles to configure Access Protection Rules in VSE and ENS:

KB81095 - How to create or modify an Access Protection Rule from a VSE 8.x or ePO 5.x console
KB54812 - How to use wildcards when creating exclusions
KB86577 - How to create an Endpoint Security Threat Prevention user-defined Access Protection rule for a file or folder registry

Use VSE Access Protection rules:

Rule1:

Rule: Common Maximum Protection - Prevent creation of new executable files in the Windows folder
Rule Category: Downloader/Payload/Isolation
Rule Aggression: Aggressive

Rule2:

Rule Type: File/Folder Blocking Rule
Process to include: winword.exe
File or folder name to block: cmd.exe
File actions to prevent: Files being executed
Rule Category: Downloader
Rule Aggression: Mildly Aggressive

Rule3:

Rule Type: File/Folder Blocking Rule
Process to include: winword.exe
File or folder name to block: powershell.exe
File actions to prevent: Files being executed
Rule Category: Downloader
Rule Aggression: Mildly Aggressive

Rule4:

Rule Type: File/Folder Blocking Rule
Process to include: *
File or folder name to block: C:\*.exe
File actions to prevent: New files being created
Rule Category: Isolation
Rule Aggression: Aggressive

Use ENS Access Protection rules:

Rule1:

Rule Name: Creating new executable files in the Windows folder
Rule Category: Downloader/Payload/Isolation
Rule Aggression: Aggressive

Rule2:

Executable1:

Inclusion: Include
File Name or Path: winword.exe

SubRule1:

SubRule Type: Files
Operations: Execute

Target1:

Inclusion: Include File, folder name, or file path 1: cmd.exe
File, folder name, or file path 2: powershell.exe
Rule Category: Downloader
Rule Aggression: Mildly Aggressive

Rule3:

Executable1:

Inclusion: Include
File Name or Path: *

SubRule1:

SubRule Type: Files
Operations: Create

Target1:

Inclusion: Include
File, folder name, or file path: C:\*.exe
Rule Category: Isolation
Rule Aggression: Aggressive

Use ENS Exploit Prevention rules:

Rule1:

Rule ID: 6087
Rule Name: PowerShell Command Restriction – EncodedCommand
Rule Category: Downloader
Rule Aggression: Aggressive

Host Intrusion Prevention (Host IPS) Proactive Measures
This section provides additional information about observed Host IPS rules triggered by known Emotet variants.

Use of Host IPS rules:

Rule1:

Rule ID: 6010
Rule Name: Generic Application Hooking Protection
Rule Category: Downloader/Payload
Rule Aggression: Aggressive

Rule2:

Rule ID: 6011 Rule Name: Generic Application Invocation Protection
Rule Category: Downloader/Payload
Rule Aggression: Aggressive

Rule3:

Rule ID: 6087
Rule Name: PowerShell Command Restriction – EncodedCommand
Rule Category: Downloader
Rule Aggression: Aggressive

Rule4:

Rule ID: 1148
Rule Name: CMD Tool Access by a Network Aware Application
Rule Category: Downloader
Rule Aggression: Aggressive

ENS with Adaptive Threat Protection (ATP) – Real Protect and Dynamic Application Containment (DAC)
ENS with ATP Real Protect, with DAC, provides next-generation protection against unknown exploits.

ENS with ATP provides full protection against all known variants of the Emotet. McAfee recommends the following ATP configuration for detection of unknown Emotet variants:

Configure the following setting in the Adaptive Threat Protection - Options Policy:

Rule Assignment = Security (default setting is Balanced)
Configure the following rules in the Adaptive Threat Protection – Dynamic Application Containment policy:

Dynamic Application Containment – Containment Rules

See KB87843 – List of and best practices for ENS DAC rules, and set the recommended DAC rules to Block as prescribed.

ENS DAC rules triggered by Emotet variants
This section provides additional information about observed DAC rules triggered by known Emotet variants. More rule enablement might not be needed to effectively contain related processes not detected by other layers of the ENS security stack.

See KB87843 – List of and best practices for ENS DAC rules, and set the recommended DAC rules to Block as prescribed:

Rule1:

Rule Name: Modifying the hidden attribute bit
Rule Category: Payload
Rule Aggression: Cautious

Rule2:

Rule Name: Executing any child process
Rule Category: Payload Rule
Aggression: Mildly Aggressive

Rule3:

Rule Name: Modifying the Services registry location
Rule Category: Payload
Rule Aggression: Mildly Aggressive

Rule4:

Rule Name: Modifying portable executable files
Rule Category: Payload
Rule Aggression: Mildly Aggressive

Rule5:

Rule Name: Creating files with the .exe extension
Rule Category: Payload
Rule Aggression: Aggressive

Affected Products

Advanced Threat Defense 4.8.x
Advanced Threat Defense 4.6.x
Advanced Threat Defense 4.4.x
Advanced Threat Defense 4.2.x
Advanced Threat Defense 4.0.x
Configuration
Email Gateway 7.6
Endpoint Security Adaptive Threat Protection
Endpoint Security for Linux Threat Prevention 10.x
Endpoint Security for Mac Threat Prevention 10.x
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
MOVE Antivirus Multi-platform 4.8.x
MOVE Antivirus Multi-platform 4.7.x
MOVE Antivirus Multi-platform 4.6.x
Security for Lotus Domino 7.5
Security for SharePoint (PortalShield) 3.5
SuperDAT Manager 2.x
Threat Prevention and Removal
VirusScan Command Line Scanner 6.1.x
VirusScan Enterprise 8.8
VirusScan Enterprise for Linux 2.0.x
VirusScan Enterprise for Linux 1.9.x
VirusScan Enterprise for Storage 1.3.x
VirusScan Enterprise for Storage 1.2.x
VirusScan for Mac 9.8
VirusScan for Mac 9.7
VirusScan for Mac 9.6
Web Gateway 9.2.x
Web Gateway 9.1.x
Web Gateway 9.0.x
Web Gateway 8.2.x
Web Gateway 8.1.x
Web Gateway 8.0.x
Web Gateway 7.8

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

How to protect against Emotet

Environment

Summary

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

How to protect against Emotet

Environment

Summary

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title