Unlimited Giveaway McAfee Endpoint Unmanaged client - no term limits

[Vitali Ortzi]

changing rule assignment to security isolates all unknown files, changing the dynamic application containment rules to "block" blocks console programs because they call conhost.exe.

View attachment 240841

ATP on default settings also blocks ransominator since it calls certutil

I remembered SEP on default failed by ransominator.
MacAfee Is definitely stronger on default settings.

 

[bayasdev]

unblocking the excute child processes rules allow C programs to run contained, seems that Mcafee only applies the other rules to the parent process (ransominator) and not to the child ones which are trusted (7zip in this case)

 

[bayasdev]

According to their documentation, those rules are only enforced to programs that are contained (unknown reputation).

 

[Vitali Ortzi]

According to their documentation, those rules are only enforced to programs that are contained (unknown reputation).

Good read would definitely look into even though I don't use MacAfee.

 

[Nagisa]

Send me screenshots of which settings you want and I'll test it

@Vitali Ortzi Btw, Both the comss.ru version and the one that I downloaded from the direct link shows the same about screen. Client is self-managed but TP, ATP, Web filter, Firewall is trial - active on both versions.

@geminis3 It would be god's work to test both SEP and MEP at the malwarehub, to see which one is better than other. I would like to test it myself with SEP but I lack experience in malware testing.

 

[bayasdev]

@Vitali Ortzi Btw, Both the comss.ru version and the one that I downloaded from the direct link shows the same about screen. Client is self-managed but TP, ATP, Web filter, Firewall is trial - active on both versions.

@geminis3 It would be god's work to test both SEP and MEP at the malwarehub, to see which one is better than other. I would like to test it myself with SEP but I lack experience in malware testing.

if you know how to work with VMs and things like that without infecting yourself, you can apply to the hub

 

[Chri.Mi]

changing rule assignment to security isolates all unknown files, changing the dynamic application containment rules to "block" blocks console programs because they call conhost.exe.

View attachment 240841

ATP on default settings also blocks ransominator since it calls certutil

EDIT: that config contains the original ransominator (calls local 7z copy) but doesn't stops it, will do further tests

in the picture u dont have select to block with dynamic application containment, is set to report only. There are more under threat prevention and ATP that u can set to block. Also u can increase many voice to high lvl or very high lvl heuristics. If u test sites for physing etc, under web control u can set to block red yellow and unrecognized sites, so only trusted will be allow. Remember to block observe mode from various settings like AMSI otherwise it will no block nothing. If u copy my settings u can set the program at decent lvl (i made that for security + report). Later i switched for just block option, without reports. Dont know mcafee use so bad default settings.

Ehm when i post screenshots many settings was on low... but u can increase to high or very high heuristics for max settings.

View attachment 240846
View attachment 240847
View attachment 240848
View attachment 240849
View attachment 240850

Why network intrusion block after 900 sec instead of 1 sec and i would use trigger application containment when reputation is unknown. The rest seems k

@geminis3
Hey just for understand... my english is not well. Your ransominator was blocked if set to block? Or it did escape cause 7zip was trusted?

 

[bayasdev]

@geminis3
Hey just for understand... my english is not well. Your ransominator was blocked if set to block? Or it did escape cause 7zip was trusted?

All C console applications call CMD (conhost.exe) so setting all those rules to block prevent any console application with unknown reputation from running.

Disabling the "execute child processes" rule allows console applications to run but seems that 7z is whitelisted so all the other rules are ignored, interestingly it blocked ransominator from creating the ransom note (readme.txt) since it triggered some of the rules.

PD: English is not my main language but I try to do my best

 

[Pat MacKnife]

I will follow this thread, i also installed McAfee ENS because i have a license from school where my daughter goes to school.
I don't test with malware, but like to tweak it a little
Installed an older version ( 10.6 ) about 2 months ago, but didn't update properly, now i asked the software academy to set latest version on the download page and give it another try.

 

[Chri.Mi]

Some1 know how to update chrome extension that is outdated? Would avoid Firefox

 

[Pat MacKnife]

Yes ENS chrome extension is from august 2019 but i feel its working good.

 

[bayasdev]

It's a shame that ENS didn't submitted their extension to Mozilla Addons like other vendors did.

 

[Vitali Ortzi]

It's a shame that ENS didn't submitted their extension to Mozilla Addons like other vendors did.

That's partly the issue with extension based web security approach.
They have to upload it to every vender from Safari to firefox.

 

[Chri.Mi]

It's a shame that ENS didn't submitted their extension to Mozilla Addons like other vendors did.

For use last mcafee on firefox u should install versione 73, it will install extension automatically, then update to latest firefox

 

[Chri.Mi]

Comss.ru has updated the client

 

[Vitali Ortzi]

Comss.ru has updated the client

Good to know .
Got no idea why it was so slow .
SEP always gets updates a lot faster
In cmoss.ru

 

[Pat MacKnife]

Can someone tell me what version McAfee Agent you have installed ? Here is 5.6.3.157 (you find it on the icon info
I think i am behind from what i seen on McAfee website...
Its important to be up-to-date because in a few days big Windows 10 2004 May update, you can read this document :

Windows 10 May 2020 Update adoption with VSE 8.8.0 Patch 9 upgrade to ENS 10.7.0 Hotfix 199847

View the Reference Configuration for Windows 10 May 2020 Update adoption with VSE 8.8.0 Patch 9 upgrade to ENS 10.7.0 Hotfix 199847.

kc.mcafee.com

 

[Chri.Mi]

Can someone tell me what version McAfee Agent you have installed ? Here is 5.6.3.157 (you find it on the icon info
I think i am behind from what i seen on McAfee website...
Its important to be up-to-date because in a few days big Windows 10 2004 May update, you can read this document :

Windows 10 May 2020 Update adoption with VSE 8.8.0 Patch 9 upgrade to ENS 10.7.0 Hotfix 199847

View the Reference Configuration for Windows 10 May 2020 Update adoption with VSE 8.8.0 Patch 9 upgrade to ENS 10.7.0 Hotfix 199847.

kc.mcafee.com

the same

 

[Pat MacKnife]

So it seems that ENS need an update for McAfee agent (recommended) for Windows 10 2004 May update, if i don't have latest version i think i will uninstall ENS before updating my Machine to Windows 10 2004 (not sure i will continue to use ENS , because that organisation lacks updating the clients)

 

[bayasdev]

Can someone tell me what version McAfee Agent you have installed ? Here is 5.6.3.157 (you find it on the icon info
I think i am behind from what i seen on McAfee website...
Its important to be up-to-date because in a few days big Windows 10 2004 May update, you can read this document :

Windows 10 May 2020 Update adoption with VSE 8.8.0 Patch 9 upgrade to ENS 10.7.0 Hotfix 199847

View the Reference Configuration for Windows 10 May 2020 Update adoption with VSE 8.8.0 Patch 9 upgrade to ENS 10.7.0 Hotfix 199847.

kc.mcafee.com

yep

PD: I used an installer from another source, that's why it's licensed
PD2: This is my malware testing VM, it has 4GB of RAM and McAfee doesn't uses too much ram in this system