Environment
- CB Defense PSC Console: All Versions
- CB Defense PSC Sensor: All Versions
Question
What policy rules should be in place to prevent DRIDEX?
Answer
- Login to the PSC Console
- Select Enforce > Policies
- Select Prevention tab
- Ensure the following policy rules are in place
- Known malware Runs or is running Terminate
- Adware or PUP Runs or is running Terminate
- Suspected malware Runs or is running Terminate
- Applications at Path **\Microsoft Office\** Communicates over the network Terminate
Additional Notes
- The above recommended policy rules are based on malware analysis performed by the Carbon Black Threat Team
- Malware analysis by the Carbon Black Threat team, indicates that a network connection from winword.exe to the domain found within the embedded macro is made. Then following the netconn, winword.exe appears to write an executable file to the user’s temp directory. See Malware Analysis: Dridex for more information
Related Content
