On those slides I will show you 7 simple steps to test different McAfee ENS protection mechanism. And as a bonus I will show you how to use MVISION Insights to react on SunBurst threat. List of tests: - OAS AMCore detection - OAS GTI detection - Access Protection - Exploit Prevention - Real Protect (ATP-RP) - Dynamic Application Containment (ATP-DAC) - Credential Theft Protection (ATP-RP-CTP) All tests made for built-in rules and conducted without using real malware, so it is safe to repeat those steps in your environment. #McAfee #MVISION #Insights #SunBurst #SolarWinds #supplychain

1. McAfee Endpoint Security testing
MVISION Insights – SunBurst IOC
05 / 01 / 21 – updated & extended
Vladyslav Radetskyi
vr@optidata.com.ua

2. I work at OptiData LLC (Ukraine).
I do dynamic malware analysis.
I also write analytics and choose news for our Facebook page.
Conduct IS training for users and technical stuff.
My job is all about presenting, implementing and supporting
various security solutions (including McAfee).
vr@optidata.com.ua
radetskiy.wordpress.com
pastebin.com/u/VRad
VR
#whoami

3. 1. MVISION Insights (brief)
2. ENS modules (short theory)
3. Testing ENS without risk for hosts (simple steps)
4. Dealing with SunBurst IOC`s (FireEye, SolarWinds intrusions)
5. Links (URL) for valuable technical moments
#agenda

4. Attention! VirusScan Enterprise EOL – 31 / 12 / 2021 KB93335
* You have one year for migration

5. • McAfee Cloud check telemetry from your hosts with ENS
• Insights provide you triage for all IOC`s from your hosts
• You get clean picture of what was detected on your systems (our video)
MVISION Insights – get additional analytics for ENS detection
* 662 for August, today is over ~780

6. ✓ ENS Platform - GUI
✓ ENS Threat Prevention - OAS, ODS, AP, ExploitPrev
✓ ENS Firewall - FW
✓ ENS Web Control - Client Web Filtering (IE, Chr, FF, Edge)
✓ ENS ATP - Adaptive (GTI, TIE, ATD, DAC, RP … )
McAfee ENS – the tools of the trade

7. ✓ ENS Platform - GUI
✓ ENS Threat Prevention - OAS, ODS, AP, ExploitPrev
✓ ENS Firewall - FW
✓ ENS Web Control - Client Web Filtering (IE, Chr, FF, Edge)
✓ ENS ATP - Adaptive (GTI, TIE, ATD, DAC, RP … )
McAfee ENS – the tools of the trade

8. • Adaptive Threat Protection:
✓ Dynamic Application Containment [DAC]
✓ Real Protect (cloud / offline)
✓ Submit unknown executables to McAfee ATD (sandbox)
✓ Rollback changes made by Ransomware (our video - Enhanced Remediation)
✓ Credential Theft Protection (LSASS.EXE)
* ATP did not replace Threat Prevention (AP an EP), only expands !
McAfee ENS ATP functions

9. 1. ENS has to be updated at least once (AMCore 0.5 – bad idea)
2. You need update not only AMCore but Exploit Prevention too
3. Efficiency of ATP is depends on reputation source availability (TIE / GTI)
! https://kc.mcafee.com/corporate/index?page=content&id=KB93324
Attention!

12. https://kc.mcafee.com/corporate/index?page=content&id=KB93324
Your ENS needs to be connected to McAfee cloud

13. 1. OAS DAT detection – test file (EICAR) or docgen 1, 2, 3
2. OAS GTI detection – test file
3. Access Protection (AP) detection – test method
4. Exploit Prevention (EP) detection – test method
5. Real Protect (ATP RP) detection – test file
6. Dynamic Application Containment (ATP DAC) detection – test
7. ATP RP Credential Theft Protection (RP Beta) – test
McAfee ENS – list of tests:

14. #1 McAfee ENS – OAS DAT detection (EICAR)

15. #2 McAfee ENS – OAS GTI detection

16. #3 McAfee ENS – Access Protection (AP) detection

17. #3 McAfee ENS – Access Protection (AP) detection

18. #4 McAfee ENS – Exploit Prevention (EP) detection

19. #4 McAfee ENS – Exploit Prevention (EP) detection

20. #5 McAfee ENS – Real Protect (ATP RP) detection

21. #5 McAfee ENS – Real Protect (ATP RP) detection

22. #5 McAfee ENS – Real Protect (ATP RP) detection

23. #6 McAfee ENS – Dynamic Application Containment detection

24. #6 McAfee ENS – Dynamic Application Containment detection

25. #6 McAfee ENS – Dynamic Application Containment detection

26. #6 McAfee ENS – Dynamic Application Containment detection

27. #6 McAfee ENS – Dynamic Application Containment detection

28. #7 McAfee ENS – Credential Theft Protection (Real Protect Beta)
https://kc.mcafee.com/corporate/index?page=content&id=KB93231

29. #7 McAfee ENS – Credential Theft Protection (Real Protect Beta)
https://kc.mcafee.com/corporate/index?page=content&id=KB93231

30. #7 McAfee ENS – Credential Theft Protection (Real Protect Beta)

31. #7 McAfee ENS – Credential Theft Protection (Real Protect Beta)

32. #7 McAfee ENS – Credential Theft Protection (Real Protect Beta)

33. SolarWinds > FireEye intrusion (news spreading timeline)

34. SolarWinds > FireEye intrusion (news spreading timeline)

35. SolarWinds > FireEye intrusion (news spreading timeline)

36. SolarWinds > FireEye intrusion (news spreading timeline)

37. SolarWinds > FireEye intrusion (news spreading timeline)

38. SolarWinds > FireEye intrusion (brief)
• There is still ongoing investigation in progress …
• It was supply chain through SolarWinds Orion Platform
• Victims are: U.S. Department of the Treasury, Department of State,
Department of Homeland Security, Department of Energy and even
National Nuclear Security Administration…
• Low profile, long term intrusion in about 18K different orgs..
• To be protected you`d have to deal with tons of IOC as quick as possible

39. MVISION Insights – SunBurst IOC`s

53. 1. https://www.mcafee.com/enterprise/en-us/downloads/security-updates.html
2. https://www.mcafee.com/enterprise/en-us/release-notes/exploit-prevention.html
3. https://www.eicar.org/?page_id=3950
4. https://kc.mcafee.com/corporate/index?page=content&id=KB53733
5. https://kc.mcafee.com/corporate/index?page=content&id=KB88828
McAfee ENS – updates & testing tools

54. 1. https://kc.mcafee.com/corporate/index?page=content&id=kb51109
2. https://kc.mcafee.com/corporate/index?page=content&id=KB85784
3. https://kc.mcafee.com/corporate/index?page=content&id=KB82450
4. https://kc.mcafee.com/corporate/index?page=content&id=KB91836
5. https://kc.mcafee.com/corporate/index?page=content&id=KB88205
6. https://kc.mcafee.com/corporate/index?page=content&id=KB54812
7. https://kc.mcafee.com/corporate/index?page=content&id=KB87843
McAfee ENS – compatibility & best practice

55. Thank you for your time
radetskiy.wordpress.com
pastebin.com/u/VRad