Solved

“Dyre” Banking Malware Nessus Check

Posted on 2015-01-22
2
381 Views
Last Modified: 2015-01-23
Hi is there a Nessus scan or audit file that can be used to check “Dyre” Banking Malware
0
Comment
Question by:cesemj
2 Comments
 
LVL 62

Accepted Solution

by:
btan earned 500 total points
ID: 40566169
If AV detects that, Nessus should be able to sieve out baed on the anomalous activities but it may not be specifically targeting Dyre http://www.tenable.com/blog/detecting-known-malware-processes-using-nessus

Hence, good that you explore using the Indicators of Compromise (IOCs) such as below. It is a XML schema that is like a signature of its traces. https://www.iocbucket.com/iocs/737ce855904ffa03094902d4b936c049bc327fb9

There is ioceditor tool that can edit it or create it. And iocfinder that collects host system data and reporting its presence http://www.mandiant.com/products/free_software/ioceditor/
http://www.mandiant.com/resources/download/ioc-finder/

Not that I know Nessus can consume OpenIOC though. But other such as TrisulRP tool to sweep for this IOC as the tool can write scripts in Ruby to automate its Trisul tasks. The blog share a .rb script that  consume an OpenIOC file, extract supported network based indicators, and sweep past traffic for matches. http://trisul.org/blog/ioc-sweeper/post.html
0
 

Author Closing Comment

by:cesemj
ID: 40567131
Thanks for pointing me in the right direction.
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Outlook 2010 Security Alert when opening Outlook 4 61
Admin account lockout 10 39
PCI Compliance - mixing SAQs 6 31
ASP server side get value 15 24
If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
Enterprise Password Manager Suites as well as Local Password managers are covered in this article.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question