Re: IFS share /QIBM and /QIBM/ProdData/OS400/DirSrv -- MIDRANGE-L

× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.

Hello,

Am 27.02.2020 um 17:32 schrieb Rob Berendt <rob@xxxxxxxxx>:

So if user BUBBA gets an attachment labeled dontopenthisyouidiot.exe and runs it and it encrypts all the files on his PC and all the shares he is currently using it would have been stopped if any of the following would have detected that the particular exe file matched a ransomware pattern?

And how is this pattern assumed to be known, so a pattern can be issued before?

Did you ever hear about spearphishing? No pattern can stop a custom tailored malware.

Just got an email from our antivirus package about someone in a different plant:

Yes, Possible Unwanted Application. That's as easy like having an EICAR file being detected.

A lot of times this is because someone brought in a thumb drive and it got scanned immediately upon being plugged in.

Best Practice would be to disable USB ports for such experiments from users. See "spearphishing" above.

:wq! PoC

PGP-Key: DDD3 4ABF 6413 38DE - https://www.pocnet.net/poc-key.asc

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.