topic Re: IPS Signature for BlackMatter Ransomware in Firewall and Security Management

IPS Signature for BlackMatter Ransomware

Noa_Moe — Tue, 19 Oct 2021 20:10:16 GMT

Hello, does anyone know if there is an IPS Signature already made for Checkpoint we can download in our normal IPS updates for the BlackMatter Ransomware?

https://us-cert.cisa.gov/ncas/alerts/aa21-291a

Or can we do a custom one with the info in the US Cert article?

Re: IPS Signature for BlackMatter Ransomware

Timothy_Hall — Thu, 21 Oct 2021 17:12:35 GMT

There are no IPS signatures for any ransomware types, that falls into the domain of the Anti-virus blade which has several signatures for Black Matter. You will want to use those if you have the Anti-Virus blade enabled.

While IPS was kind of the "original Threat Prevention" and had lots of signatures for things like eDonkey/Gator/Nimda and such, all that got cleaned up in R80 as many IPS signatures got migrated into the "proper" blades as described here: sk103766: List of IPS Protections removed in R8X.x. Although IPS still has a signature for the EICAR test virus to this day which I find perplexing...

But anyway if you can't or don't want to use the Anti-Virus blade for this, your best bet is to create a custom SNORT signature for your IPS blade matching Black Matter, I'm sure you could probably locate the proper SNORT rule(s) for it with a bit of research. All of the above is covered in my new IPS/AV/ABOT Immersion video series as well as Custom Threat Indicators (strongly preferred over the much older SNORT-based signatures) which you can't use in this case because they only function with AV and ABOT.

Re: IPS Signature for BlackMatter Ransomware

D_TK — Thu, 21 Oct 2021 17:12:58 GMT

I've been asked to show proof of protection from "blackmatter"... is there a way to look these up the protections in AV/AB blade? not sure what they're called - i've tried w.32.blackmatter, and a few other variations, and couldn't find anything.

thanks.

Re: IPS Signature for BlackMatter Ransomware

Noa_Moe — Thu, 21 Oct 2021 17:21:06 GMT

I found the BlackMatter AV protections listed in the ThreatWiki but not able to search that is was applied either. https://threatwiki.checkpoint.com/threatwiki/public.htm

Re: IPS Signature for BlackMatter Ransomware

Timothy_Hall — Thu, 21 Oct 2021 17:23:13 GMT

Go to the ThreatWiki (https://threatwiki.checkpoint.com/threatwiki/public.htm) and search for blackmatter to get the protection names:

Re: IPS Signature for BlackMatter Ransomware

Tal_Paz-Fridman — Fri, 22 Oct 2021 10:07:32 GMT

Check Point Harmony Endpoint provides protection against this threat:

https://threatpoint.checkpoint.com/ThreatPortal/threat?threatType=publication&threatId=4561