McAfee QUICKCLEAN 3.0 User's Guide download pdf (Page 84)

analysis. For static analysis, McAfee Advanced Threat Defense uses the following resources and in

the same order:

• Local whitelist — This is the list of MD5 hash values of trusted files, which need not be analyzed.

This whitelist is based on the McAfee

Application Control database that is used by other

solutions in the McAfee suite. This has over 230,000,000 entries.

The whitelist feature is enabled by default. To disable it, use the setwhitelist command. There

are commands to manage the entries in the whitelist. The static McAfee

Application Control

database cannot be modified. However, you can add or delete entries based on file hash. You

can also query the whitelist for a certain file hash to see if it has been added to the database.

The McAfee products that submit files to McAfee Advanced Threat Defense do have the

capability to perform custom whitelisting as well. This includes the McAfee Web Gateway and

the McAfee Network Security Platform

See whitelist on page 137 for the commands.

• Local blacklist — This is the list of MD5 hash values of known malware stored in the McAfee

Advanced Threat Defense database. When McAfee Advanced Threat Defense detects a malware

through its heuristic McAfee Gateway Anti-Malware engine or through dynamic analysis, it

updates the local blacklist with the file's MD5 hash value. A file is added to this list automatically

only when its malware severity as determined by McAfee Advanced Threat Defense is medium,

high, or very high. There are commands to manage the entries in the blacklist.

See Blacklist on page 126 for the commands.

• McAfee GTI — This is a global threat correlation engine and intelligence base of global messaging

and communication behavior, which enables the protection of the customers against both known

and emerging electronic threats across all threat areas. The communication behavior includes

the reputation, volume, and network traffic patterns. McAfee Advanced Threat Defense uses

both the IP Reputation and File Reputation features of GTI.

• Gateway Anti-Malware — McAfee Gateway Anti-Malware Engine analyzes the behavior of web sites,

web site code, and downloaded Web 2.0 content in real time to preemptively detect and block

malicious web attacks. It protects businesses from modern blended attacks, including viruses,

worms, adware, spyware, riskware, and other crimeware threats, without relying on virus

signatures.

McAfee Gateway Anti-Malware Engine is embedded within McAfee Advanced Threat Defense to

provide real-time malware detection.

• Anti-Malware — McAfee Anti-Malware Engine is embedded within McAfee Advanced Threat Defense.

The DAT is updated either manually or automatically based on the network connectivity of

McAfee Advanced Threat Defense.

• Dynamic analysis — In this case, McAfee Advanced Threat Defense executes the file in a secure VM and

monitors its behavior to check how malicious the file is. At the end of the analysis, it provides a

detailed report as required by the user. McAfee Advanced Threat Defense does dynamic analysis

after the static analysis is done. By default, if static analysis identifies the malware, McAfee

Advanced Threat Defense does not perform dynamic analysis. However, you can configure McAfee

Advanced Threat Defense to perform dynamic analysis regardless of the results from static

analysis. You can also configure only dynamic analysis without static analysis. Dynamic analysis

includes the disassembly listing feature of McAfee Advanced Threat Defense as well. This feature

can generate the disassembly code of PE files for you to analyze the sample further.

• Analyzer VM — This is the virtual machine on the McAfee Advanced Threat Defense that is used for

dynamic analysis. To create the analyzer VMs, you need to create the VMDK file with the required

operating system and applications. Then, using SFTP, you import this file into the McAfee Advanced

Threat Defense Appliance.

Configuring McAfee Advanced Threat Defense for malware analysis

Terminologies

McAfee Advanced Threat Defense 3.0.4 Product Guide

1 2 ... 79 80 81 82 83 84 85 86 87 88 89 ... 139 140

Comments to this Manuals

No comments

McAfee QUICKCLEAN 3.0 User's Guide Page 84

Comments to this Manuals

Related products and manuals for Networking McAfee QUICKCLEAN 3.0