CB PSC: How to Prevent DRIDEX?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What policy rules should be in place to prevent DRIDEX?

Environment

• CB Defense PSC Console: All Versions
• CB Defense PSC Sensor: All Versions

Resolution

1. Login to the PSC Console
2. Select Enforce > Policies 
3. Select Prevention tab
4. Ensure the following policy rules are in place
   • Known malware Runs or is running Terminate
   • Adware or PUP Runs or is running Terminate
   • Suspected malware Runs or is running Terminate
   • Applications at Path **\Microsoft Office\** Communicates over the network Terminate

Additional Information

• The above recommended policy rules are based on malware analysis performed by the Carbon Black Threat Team
• Malware analysis by the Carbon Black Threat team, indicates that a network connection from winword.exe to the domain found within the embedded macro is made. Then following the netconn, winword.exe appears to write an executable file to the user’s temp directory. See https://community.carbonblack.com/t5/Threat-Research-Docs/Malware-Analysis-Dridex/ta-p/45857 for more information