Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
cezar_varlan1
Collaborator

CP Signature detections and naming convention

What is the meaning of "HEUR":Exploit.Signature in the signature detection phase?

Does this mean it's some kind of heuristic signature?

For example:

On ThreatWiki | Check Point Software  i need to search for Exploit.Msoffice.Cve-2017-0199.ex

However in the detection alert i have:

HEUR:Exploit.Msoffice.Cve-2017-0199.ex

2 Replies
G_W_Albrecht
Legend
Legend

That seems a logical answer - which values apart from HEUR: are else displayed in the signature detection phase?

CCSE CCTE CCSM SMB Specialist
0 Kudos
cezar_varlan1
Collaborator

I can see some more values:

UDS

not-a-virus

Are those values explained somewhere? The pink console of R80.20 SmartConsole and the yellowish traditional R77.30 SmartEndpoint make for a good blend of windows, but the fact is we have no clear explanation of what we are seeing. And combined with the fact that the logging is borderline dysfunctional for search purposes (see discussion here Endpoint Logging - Events ) i have the clear feeling we are doing Empirical Security here. We have a good hunch as to what is happening but we can't know for sure - i mean, we should go for the well known Check Point Sandblast Mobile approach where there's one Button saying "OK" or one button "NOT OK" and leave the investigations for support or something like that. 

Am i missing some kind of documentation?  I've checked Admin Guides and support center. Found some reference here in sk131312 but this one only states how to create an exception but does not list all protections.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events