Unlimited Giveaway McAfee Endpoint Unmanaged client - no term limits

[Pat MacKnife]

Resource

Here its using about 400

 

[Vitali Ortzi]

Resource

Here its using about 400

A lot of av software use a dynamic ram management based on ram availability .
More ram the AV use lower Av IO usage and allow faster scaning / detection .
Downside is that it will lower prefetch data/software ram.
Worst case scenario in some very low end pc it can cause issues like crashing in low ram systems .

 

[Nagisa]

yep

View attachment 241009

PD: I used an installer from another source, that's why it's licensed
PD2: This is my malware testing VM, it has 4GB of RAM and McAfee doesn't uses too much ram in this system

View attachment 241010

Where did you get the installer file? The one that vitali sent?


Btw, I have some doubts about the results of your bonus tests of McAfee. Afaik, GTI works like cloud signatures, so even when you disable file scanning, it may has more than behavioural detection. I haven't read the documentation yet, so I, too don't know how it works exactly.

 

[Vitali Ortzi]

Where did you get the installer file? The one that vitali sent?


Btw, I have some doubts about the results of your bonus tests of McAfee. Afaik, GTI works like cloud signatures, so even when you disable file scanning, it may has more than behavioural detection. I haven't read the documentation yet, so I, too don't know how it works exactly.

Yep exactly.
It includes a license workaround in case of an issue in that regard.

 

[Chri.Mi]

Good to know .
Got no idea why it was so slow .
SEP always gets updates a lot faster
In cmoss.ru

Cause more ppls use it and report them when new version exists. I think mcafee is a bit ignored. Honestly i didnt know about this mcafee trial for ever, but i knew about symantec from around 5 years. Later is common thing symantec is superior vs mcafee, but i have some doubt comparing the 2 solutions (specially unmanaged vs unmanaged)

 

[Vitali Ortzi]

Cause more ppls use it and report them when new version exists. I think mcafee is a bit ignored. Honestly i didnt know about this mcafee trial for ever, but i knew about symantec from around 5 years. Later is common thing symantec is superior vs mcafee, but i have some doubt comparing the 2 solutions (specially unmanaged vs unmanaged)

Yeah not a fair comparison because unlike MacAfee SEP GUI lacks the options that makes the real difference between Norton and endpoint products .

 

[bayasdev]

Where did you get the installer file? The one that vitali sent?


Btw, I have some doubts about the results of your bonus tests of McAfee. Afaik, GTI works like cloud signatures, so even when you disable file scanning, it may has more than behavioural detection. I haven't read the documentation yet, so I, too don't know how it works exactly.

Reading the logs it says known malicious reputation, so it's like Kaspersky's System Watcher using UDS cloud signatures
EDIT: a more fair test would be disabling internet access for bonus tests and see how ATP reacts without the Cloud

 

[bayasdev]

Offline BONUS Test

I used 22/05/2020 signatures

(HIT) ATP Rule

(HIT) ATP Rule

PD: This config without internet access is an FP making machine, it even blocked me from running 7zip to extract the samples so I had to temporarly disable it.

 

[Nagisa]

@Vitali Ortzi

Apparently, there is no official McAfee Endpoint Security download without the time limit. Doesn't it count as piracy to use it with workarounds? I also wonder how that workaround works by, and where did you get that installation file from.

There is a topic for SEP too. They're saying that unmanaged client needs licencing as well. What do you think?

Do I need a paid license for an unmanaged client? | Endpoint Protection

I have SEP 12.1 installed as an unmanaged client and have found it unable to take live updates. Do I need a paid license in order to receive live updates? What

community.broadcom.com

 

[Vitali Ortzi]

@Vitali Ortzi

Apparently, there is no official McAfee Endpoint Security download without the time limit. Doesn't it count as piracy to use it with workarounds? I also wonder how that workaround works by, and where did you get that installation file from.

There is a topic for SEP too. They're saying that unmanaged client needs licencing as well. What do you think?

Do I need a paid license for an unmanaged client? | Endpoint Protection

I have SEP 12.1 installed as an unmanaged client and have found it unable to take live updates. Do I need a paid license in order to receive live updates? What

community.broadcom.com

They don't allow submissions without SEP license
"SEP 12.1 unmanaged client requires the licenses.To enable the submission of reputation data from an unmanaged client, you must install a paid license on the client"

 

[Chri.Mi]

@Vitali Ortzi

Apparently, there is no official McAfee Endpoint Security download without the time limit. Doesn't it count as piracy to use it with workarounds? I also wonder how that workaround works by, and where did you get that installation file from.

There is a topic for SEP too. They're saying that unmanaged client needs licencing as well. What do you think?

Do I need a paid license for an unmanaged client? | Endpoint Protection

I have SEP 12.1 installed as an unmanaged client and have found it unable to take live updates. Do I need a paid license in order to receive live updates? What

community.broadcom.com

For what i understand u can use trials free without limit time... Is what is write in comss.ru for sep and mcafee.

 

[Vitali Ortzi]

For what i understand u can use trials free without limit time... Is what is write in comss.ru for sep and mcafee.

Exactly what's written in Cmoss.ru
License terms.
Cmoss.ru is a highly trusted site and included in trusted giveaway thread in MalwareTips.

 

[Chri.Mi]

The link from where comss.ru get mcafee is the product site, so is trusted

 

[bayasdev]

I don't think this is the panacea of "free" AVs, it needs a lot of tweaking with exploit prevention rules to get optimal protection against fileless attacks.

I've conducted a personal test with ENS using my custom settings and Avast Free with HM vs a Netwalker fileless ransomware sample with very low detection (4/59).

VirusTotal

VirusTotal

www.virustotal.com

ENS at default exploit prevention rules failed against Netwalker

Avast already detected the file by signatures, so I rolled back the test VM to an old snapshot and cut the internet access to prevent it from calling the cloud.

Behavior shield managed to block it and protected our files from fileless Netwalker.

PD: With this post I'm not saying "hey go and install Avast right now", instead I'm clarifying about the default settings of McAfee ENS.

 

[bayasdev]

@geminis3 It seems I'm not yet approved for malware testing, so could you also test SEP(at max settings) for me, with the same ransmoware you tested above?

that will require some time because I'll need two VMs, one with SPEM to change the advanced settings and a test VM with SEP

 

[Chri.Mi]

I don't think this is the panacea of "free" AVs, it needs a lot of tweaking with exploit prevention rules to get optimal protection against fileless attacks.

I've conducted a personal test with ENS using my custom settings and Avast Free with HM vs a Netwalker fileless ransomware sample with very low detection (4/59).

VirusTotal

VirusTotal

www.virustotal.com

ENS at default exploit prevention rules failed against Netwalker

View attachment 241051
View attachment 241055


Avast already detected the file by signatures, so I rolled back the test VM to an old snapshot and cut the internet access to prevent it from calling the cloud.

View attachment 241052
View attachment 241049
View attachment 241053
View attachment 241054

Behavior shield managed to block it and protected our files from fileless Netwalker.

PD: With this post I'm not saying "hey go and install Avast right now", instead I'm clarifying about the default settings of McAfee ENS.

Is there any option for make mcafee effective vs this? If yes can u share?

 

[bayasdev]

Is there any option for make mcafee effective vs this? If yes can u share?

set all the exploit prevention rules to block and enjoy the FP fest in your machine.

Edit: in this very specific scenario set to block the powershell execution policy bypass rule

 

[Chri.Mi]

set all the exploit prevention rules to block and enjoy the FP fest in your machine.

Just for clarify... are u refering the ones in threat prevention where is write for example about block doppelganger, mimikatz, etc or rules down? or the rules under advanced threat protection?

 

[bayasdev]

Just for clarify... are u refering the ones in threat prevention where is write for example about block doppelganger, mimikatz, etc or rules down? or the rules under advanced threat protection?

The exploit prevention ones

 

[Chri.Mi]

I made some custom rules under TP Rules for allow applications in folders programs, programs x86, windows and download to run if the applications are signed and block all the remains folders and unsigned apps.
Got some tips from Regole di protezione dell'accesso definite da McAfee - McAfee Endpoint Security 10.5.0 - Prevenzione delle minacce - Windows