RYUK Trying to find out if there any policy or normal AMCore Dat protect system?

[ellipwk]

RYUK Trying to find out if there any policy or normal AMCore Dat protect system? Click through link on McAfee web site and ther no information. Boss asked this question. Is there an option to search the “signatures” that will show us Mcafee is prepared? Like this RYUK ransomware for instance

[Former Member]

Hi @ellipwk 

Our AMCORE Content already has coverage for it, however to confirm it's the variant you are specifically asking about, we would need an IOC or samples from yourself.

We do have a threat advisory for Ryuk as well but we've since migrated some of our documents to another platform and right now I can't find the right link. I'll update this thread later once re-discovered 🙂

[Former Member]

This is the KB I wanted to share with you: KB91844

[AdithyanT]

Hi @ellipwk,

Thank you for your post! Adding to @chealey 's response:

Have you had a chance to review this?

https://www.mcafee.com/enterprise/en-us/threat-center/threat-landscape-dashboard/ransomware-details....

Why cannot McAfee confirm coverage based on Malware Name and why do we need a sample or Hash value?

It is very important to note that each malware under one name can have multiple variants comprising multiple files that perform different attacks at different levels. Hence, coverage need to be confirmed using specific hashes and samples.

I hope this helps!

[ycarrion]

Is there any department that is working to identify variants of home threat ransomeware? since they are many and all need coverage

[Former Member]

Hi @ycarrion 

Our labs team are very proactive and are constantly reviewing new variants of any Malware seen. We don't just sit back and twirl our thumbs until a customer submits a sample 🙂

When customers ask us to confirm coverage, it is crucial that we get the IOC or sample they are referring to so that we can fully confirm our detection of that specific variant. Otherwise we'd just be making a very generic statement and that is of no use to anyone.

Apart from this, we have other teams who work on adding new content to other areas of the product i.e. the TIE rules for ATP or EP Content for ENS. All of these rules catch other types of intrusions and threats that can't be easily detected by content quite as easily.

[Daveb3d]

Do you havew ATP installed?