Title

(U) The Trellix ENS Threat Prevention Options must be configured to enable Anti-Malware Scan Interface (AMSI). (Cat II impact)

Discussion

(U) Malware and other threats can attempt to obfuscate or hide their malicious code in some script files. This rule prevents scripts that appear to be obfuscated from running. It uses the AMSI to determine if a script is potentially obfuscated and then blocks such a script or blocks scripts when an attempt is made to access them.

Check Content

(U) Access the ePO server console. Select Menu >> Policy >> Policy Catalog. From the "Product" list, select "Endpoint Security Threat Prevention". From the "Category" list, select "On-Access Scan". Select each configured On-Access Scan policy. Verify Antimalware Scan Interface (Windows only) >> "Enable AMSI (provides enhanced script scanning) (Windows only)" is selected. Verify Antimalware Scan Interface (Windows only) >> "Enable Observe mode (Events are generated but actions are not enforced)" is not selected. If Antimalware Scan Interface (Windows only) >> "Enable AMSI (provides enhanced script scanning) (Windows only)" is not selected, this is a finding. If Antimalware Scan Interface (Windows only) >> "Enable Observe mode (Events are generated but actions are not enforced)" is selected, this is a finding.

Fix Text

(U) Access the ePO server console. Select Menu >> Policy >> Policy Catalog. From the "Product" list, select "Endpoint Security Threat Prevention". From the "Category" list, select "On-Access Scan". Select each configured On-Access Scan policy. Select the Antimalware Scan Interface (Windows only) >> "Enable AMSI (provides enhanced script scanning) (Windows only)" option. Deselect the Antimalware Scan Interface (Windows only) >> "Enable Observe mode (Events are generated but actions are not enforced)" option. Click "Save".

Additional Identifiers

Rule ID: SV-270891r1055822_rule

Vulnerability ID: V-270891

Group Title: SRG-APP-000210

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.