 |
 |
|
Try our new Certificate Revocation List Check Tool CRLcheck.exe is a tool developed to verify digital signatures of executable files. It collects files from known paths on your client, checks their signature, and checks Certificate Revocation Lists (CRL) and OCSP download. This helps avoid delays in launching files. |
||
Trellix EPO 5.10 base install or upgrade fail Rollback with SQL 2022 Express Does also happen with: EPO5100_ServicePack1_4098_LR1.zip (lATEST DOWNLOAD 01.05.2024) Just had a case where we searched for longer, but it was NOT related to a dual install of WSUS+EPO. Because we sometimes have a dual install of EPO and WSUS roles on the […]
Exploit/Lücken CVE-2023-5444 (RISK HIGH) und CVE-2023-5445. Update Mcafee/Trellix EPO Management Server There is emergency patch for EPO and the Trellix Forum seems to be down or rebuilt? Here is some info to help you this way. We have just updated around 10 EPO on-premises installations from EPO 5.10 SP1 to UPD2 or from 5.10 […]
Antivirus Exclusion for NON Windows Defender In the world of IT security, antivirus tools like Windows Defender are our go-to guardians against all sorts of threats. But sometimes, we need to make exceptions for certain stuff related to Microsoft Intune. Now, here’s the deal (See end of this Blog entry below) Windows Defender has this […]
Had a case where the McAfee EPO DB almost blew due to an EPO issue or, let’s say, McAfee prevented it from happening by encountering SQL Express limitations. We’re relieved that since EPO 5.X, they’ve implemented two databases; one for EPO and one for Events; effectively splitting the load in size and safeguarding the crucial […]
For all DBA’s > Yes we know but Mcafee tells us to shrink 😉 Also see our security concerning regarding centralizes SQL for Security Appliances/Servers. Problem: You are unable to shrink the Mcafee EPO SQL Database with Management Studio (GUI). You are already on “SIMPLE RECOVERY” mode for the DB. Management […]
Ransomware in der Schweiz Lösungsansätze für mehr Cybersicherheit Die Bedrohung durch Ransomware in der Schweiz erfordert intelligente Lösungen. Eine effektive Methode, die sich bewährt hat, ist der Einsatz von “Black/White-Listing” Technologien, wie sie beispielsweise von McAfee TIE bereitgestellt werden. Diese fortschrittliche Technologie, die auf intelligenter Listenführung basiert, stellt derzeit die einzige wirksame Lösung dar, um […]
McAfee Endpoint Security Platform for Linux and McAfee Endpoint Security for Linux Threat Prevention Mcafee/Trellix is one of the security vendors which cover every client OS. I personal only work with Linux based on CENTOS Stream private or on the job with security appliances or MDM managment Servers. I love Centos and it has […]
Update to 5.10.0 Service Pack 1 BUILD 4098 There is an issue with EPO 5.10.0 Service Pack 1 RE-Post. We have seen some EPO 5.10.0 Service Pack 1 gone through smooth and some larger EPO fail. Trellix member CDINET from Trellix Forum stated a tip how to install sucessfully. Here is how to solve the […]
THIS KB is valid for EPO4/5 until 5.1 and even with the SPLIT in TWO database this still happens in 2024. We just had a case where the OrionAuditlog table was 22GB+ on the MAIN DB. Sample Problem: VMWARE Monitoring Events from “Vmware Converter and Tools” fill the EPO Database rapidly (1GB/Hour). delete from EPOEvents […]
Trellix ENS 10.X, T1056 – Key capture using PowerShell detected, Host intrusion buffer overflow ExP:Illegal API Use Blocked an attempt to exploit C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE, which targeted the GetAsyncKeyState API. For efficient M365 and Exchange Online management, there are various methods available. While utilizing the PowerShell button within the Admin Portal is one option, it requires an Azure […]
Mcafee posted a fixed version of the 10.7 June 2022 release. Hidden in the release notes you will find an important detail. You can now EXCLUDE Signature/Exploit/IPS rules FOR certain Active Directory users or group by SID. This is like a WMI filter for GPO Group Policy to drill down more granular and to target […]
Database Configuration: Ensure the following settings for the EPO Database: Autoshrink: False Auto Close: False Auto Update Statistics: True These settings prevent unnecessary shrinking and closing of the database, while maintaining up-to-date statistics for efficient performance. Customization for Rare Circumstances: While Auto Update Statistics is generally recommended as true, there might […]
Sample: Analyzing and Resolving “STOP pending” Status for McAfee Tomcat Service 1. Identify Stuck Service: – Open Command Prompt with administrative privileges. – Dump the list of all services to a text file using the command: `sc query > service_list.txt` 2. Inspect Service List: – Open the generated text file using a text editor like […]
Hallo, Es gibt einen neuen Release eines Tools mit welchen man Clients scannen kann und alles was es nicht kennt (spanisch vorkommt) vollautomatisch zu Mcafee GTI sendet. Man kann damit unbekannte Files an McAfee einsenden zur Analyse. Falls man eine E-Mail Adresse angibt bekommt man am Schluss den Report nach der Analyse. Die […]
Trellix/MCAFEE ATD: Sandbox stays at STATUS BAD We just had a case where an MCAFEE ATD-3000 Sandbox was staying at the Status BAD. A person hat submitted a file to analyse with XVIEW (Look into the Sandbox) and did shutdown the VM after that analyse. NO > Rebuild of the VM’s did not solve NO […]
