Jump to content

pbust

Staff
 View Profile  See their activity

  • Posts

    3,369

  • Joined

  • Last visited

 Content Type 

Posts posted by pbust

    ALL iObit Programs

    in File Detections

    Posted

    Unfortunately this is the nature of our generic/signatureless remediation technology (i.e. linking engine) which finds malware artifacts related to the original detected malware/PUP. There are some PUPs that are very large in size and this is an unfortunate side effect. On the positive side, it allows us to be really good at malware remediation.

    We do have an internal project ongoing to takes a different approach that might solve this for PUPs, but that project is still in incubation.

     

     

    Advanced System Care 10

    in File Detections

    Posted

    Our Research Team has been monitoring this application for some time and has decided to add detection based on triggers against our PUP detection criteria.
    https://blog.malwarebytes.com/malwarebytes-news/2016/10/malwarebytes-gets-tougher-on-pups/

    The detection is correct and not a false positive. We will continue monitoring this application and if we notice a change in the behavior we will review it again.

    If for whatever reason you want to continue using Advanced SystemCare, you can simply uncheck the detections and click Next after a scan with MBAM, and the prompt will ask you if you want to "Ignore Once" or "Ignore Always". If you Ignore Always it won't be detected any more.

     

    Welcome to the Malwarebytes Incident Response Beta

    in Malwarebytes Incident Response Beta

    Posted · Edited by pbust

    We are happy to announce the public beta of our upcoming cloud-based platform for Incident Response for companies.

    Malwarebytes Incident Response incorporates the following key high-level features:

    • Cloud-based management console
    • Dashboard views
    • Endpoint & asset management
    • Policy and group management
    • Scheduled scans
    • Malware discovery and remediation

    This is a great opportunity for you to get an early glimpse of our new Malwarebytes Incident Response built on our new Cloud Platform.

    We are looking for beta testers who can deploy Malwarebytes Incident Response in a business environment to at least 5 endpoint Windows machines. If you want to become a Beta tester we will set you up with an account and instructions on how to get started. To sign up simply send an email to DL-NebulaBeta@malwarebytes.com.

     

     

    Additional Mitigations

    in Anti-Exploit Beta

    Posted

    EMET has some EMET-specific mitigations and limited in nature as compared to MBAE.

    For example, EMET has ASR which basically disables a bunch of content in certain applications. They do this since they cannot protect from exploits through those applications, while MBAE's Layer3 can (think Java exploits, application design abuses, etc.).

    OTOH EMET has some anti-detouring since it uses Detours. But MBAE does not need those since it uses a different approach.

    Last but not least, MBAE uses a multi layer approach to mitigations and the mitigations we have in place are the ones that make the most amount of sense to us to deal with exploits ITW. MBAE is also supported and maintained actively, while EMET is not.

     

    Feeding MBAE event data to SIEM

    in Malwarebytes Anti-Exploit for Business

    Posted

    We currently don't have direct integration into LogRhythm or other SIEMs. It all needs to go through a syslog first and then feed the events from the syslog to the LogRhythm SIEM. Our Sales Engineers have a library of integration scripts into a bunch of different SIEMs and other network tools (Breach Detection Systems, Endpoint manangement frameworks, etc.). Send me a PM and I'll put you in touch if you are interested in those.

     

    Feeding MBAE event data to SIEM

    in Malwarebytes Anti-Exploit for Business

    Posted

    Welcome to the forum cmorris.

    There's two ways to do this:

    1- Forward events from centralized Malwarebytes Management Console to a syslog server. This can be activated from the "Admin" pane.

    2- Enable syslog support on each endpoint (by simply creating a registry key and some values) and point each endpoint to submit their MBAE events directly to the syslog server, bypassing the Management Console. Details for this can be found towards the end of the "MBAE Admin Guide".

     

     

    Exploit payload from UNC blocked

    in Malwarebytes Anti-Exploit for Business

    Posted

    This is by design as some exploits use WebDAV and UNC paths to deliver their payload. So our MBAE Layer3 Application Behavior protection blocks this generically. Since exploits ITW haven't used this technique for many many years, you can safely disable this under Advanced settings -> Application Behavior and disable the UNC protection for browsers. MBAE still has dozens of other layers that will protect against similar exploits, so you are not really reducing your effective protection.

     

     

    Blocking VBscript in static local files installed in Program Files folder

    in Exploit

    Posted

    VB Scripting has been decomissioned by Microsoft some time ago due to the insecurities it introduces.

    In fact during all of 2016 Exploit Kits were heavily abusing outdated computers with VBScript in order to exploit machines and execute code remotely on them. It is advisable that you do not use any products or applications that rely on VBScript.

    Alternatively you can disable the VBScript enforcement technique in MB3 -> Settings -> Protection -> Advanced Settings -> Application Hardening, but it is probably safer to find an alternative to IDM that doesn't leave you more exposed to exploits.

     

     

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.