![\"\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/02\/Configuration-screen.png\")
<\/p>\nEmail remains a top vector for attackers.\u00a0 Over the years, defenses have evolved, and policy-based protections have become standard for email clients such as Microsoft Outlook and Microsoft Mail.\u00a0 Such policies are highly effective, but only if they are maintained as attacker\u2019s keep changing their tactics to evade defenses.\u00a0 For this reason, McAfee endpoint products use a combination of product features and content for increased agility.\u00a0 In McAfee Endpoint Security (ENS) 10.5+, such protection is enabled via the \u2018Detect suspicious email attachments\u2019 option and maintained through DAT content.\u00a0 This capability goes beyond the level of protection offered by email clients by not only blocking applications and scripts, but also a variety of threat types in their native form, as well as those compressed and contained within archives and other formats.<\/p>\n
<\/p>\n
Figure 1 – ENS 10.6.1 Configuration Screen<\/em><\/p>\n An example of this capability in action can be seen against a recent spam run.<\/p>\n In this campaign, a malicious email message contained the attachment BANK DETAILS.ZIP.\u00a0 Inside this archive was the file BANK DETAILS.ISO.\u00a0 Malicious ISO spam has been increasing over the past six months, and while it is common for ISO files to be blocked by email clients, this is not the case where the ISO is inside of a ZIP.\u00a0 Inside the BANK DETAILS.ISO file resides BANK DETAILS.EXE.\u00a0 Email clients will typically block executable files attached to messages, but not if they are inside a container.<\/p>\n When the email client attempts to write the attachment to disk, ENS scans inside the ZIP and subsequently the contained ISO and EXE files (ZIP -> ISO -> EXE).<\/p>\n Figure 2 – ENS Toaster Popup<\/em><\/p>\n In this case, 2-year-old DAT content proactively stopped the threat.<\/p>\n If the system had not been protected, an unsuspecting user might open the ZIP to reveal the ISO.<\/p>\n Figure 3 – Inside ZIP file showing ISO file<\/em><\/p>\n The ISO can then be accessed via Windows Explorer, which appears as a DVD Drive containing the executable, password-stealing, payload.<\/p>\n Figure 4 – EXE file inside Bank Details.ISO<\/p>\n Since the advent of policy-based email attachment blocking, attackers have continued to seek ways to evade that protection. ISO abuse may be the latest chapter in the story, but others are sure to follow.<\/p>\n Tens of thousands of new and unique malicious attachments are blocked each month via the \u2018Suspicious Attachment\u2019 detection feature.<\/p>\n","protected":false},"excerpt":{"rendered":" Email remains a top vector for attackers.\u00a0 Over the years, defenses have evolved, and policy-based protections have become standard for…<\/p>\n","protected":false},"author":906,"featured_media":93271,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[],"coauthors":[4989],"class_list":["post-94351","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mcafee-labs"],"acf":[],"yoast_head":"\nBANK DETAILS.ZIP<\/h2>\n
![\"\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/02\/Toaster-popup.png\")
<\/p>\n![\"\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/02\/Zip-file.png\")
<\/p>\n![\"\"](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2019\/02\/EXE-file.png\")
<\/p>\n