Bad Rabbit Ransomware - Outbreak filters of ESA

[pbabu6001]

Hi Support team,

Could you please let us know, how can I check whether the Rabbit Ransomware updated in ESA or not?

Do I need to check for Outbreak filters or Anti-Virus?

Many thanks!

[Libin Varghese]

AMP (Advanced Malware Protection) and Sophos anti-virus on ESA should be blocking all known variants of Bad Rabbit ransomware.

Please go through following article for more information:
https://community.sophos.com/kb/en-us/127730
https://nakedsecurity.sophos.com/2017/10/24/bad-rabbit-ransomware-outbreak/
http://blog.talosintelligence.com/2017/10/bad-rabbit.html

Regards,

Libin Varghese

[pbabu6001]

Hi Libin,

Thanks for your information.

We have enabled SOPHOS anti-virus on our ESA, but not AMP.

Is there any impact on our users as we are not using AMP regarding this threat?

Many thanks!

[Libin Varghese]

Adding AMP as an additional layer of scanning would definitely be helpful.

Do note that AMP performs dynamic analysis of the attachment as it is received while Sophos uses IDE rules pushed to the appliance to determine malicious content.

Both scanning engines and completely different ways of functioning and recommendation would always be to use both to stay protected against unknown variants of the threat.

Regards,

Libin Varghese