Environment
- CB Defense PSC Console: All Versions
- CB Defense PSC Sensor: All Versions
Question
What policy rules should be in place to prevent DRIDEX?
Answer
Based on the malware analysis by the Carbon Black threat time, the following policy rules are recommended:
- Known malware Runs or is running Terminate
- Adware or PUP Runs or is running Terminate
- Suspected malware Runs or is running Terminate
- Applications at Path **\Microsoft Office\** Communicates over the network Terminate
Additional Notes
- Malware analysis by the Carbon Black Threat team, indicates that a network connection from winword.exe to the domain found within the embedded macro is made. Then following the netconn, winword.exe appears to write an executable file to the user’s temp directory. See Malware Analysis: Dridex for more information
Related Content
