DTAM151 - McAfee VirusScan Access Protection: Anti-Virus Standard Protection must be set to prevent IRC communication.

Information

Internet Relay Chat (IRC) is the preferred communication method used by botnet herders and remote-access trojans to control botnets (a set of scripts or an independent program that connects to IRC). IRC allows an attacker to control infected machines that are sitting behind network address translation (NAT), and the bot can be configured to connect back to the command and control server listening on any port.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the ePO server console System Tree, select the Systems tab, select the asset to be checked, select Actions, select Agent, and select Modify Policies on a Single System. From the product pull down list, select VirusScan Enterprise 8.8.0. Select the policy associated with the Access Protection Policies. Under the Access Protection tab, locate the 'Access protection rules:' label. In the 'Categories' box, select 'Anti-Virus Standard Protection'. Select both 'Prevent IRC communication' (Block and Report) options. Select Save.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_McAfee_VirusScan88_Managed_Client_V5R20_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001170, Rule-ID|SV-55257r3_rule, STIG-ID|DTAM151, Vuln-ID|V-42529

Plugin: Windows

Control ID: 77e4f412376a26091a7e72322ddb9baea45f5e1df6fd4ae5f6986c69a277e78f