Did Sonicwall released any IPS / GAV signature for to prevent Kraken fileless attack?

Ajishlal

Hi,

Did Sonicwall released any IPS / GAV signature for preventing the Kraken fileless attack which is abuses Microsoft Windows Error Reporting (WER)?

shiprasahu93

Hello @Ajishlal,

I just received confirmation from the IPS/GAV team that the following signatures in GAV should be able to block Kraken fileless attack.

GAV: Kraken.RSM_5 (Trojan)

GAV: KrakenCrypt.RSM_2 (Trojan)

GAV: Kraken.RSM_2 (Trojan)

GAV: Kraken_2 (Trojan)

Thanks!

shiprasahu93

Hello @Ajishlal,

I am checking on this with the IPS/GAV team. I will keep you posted!

Ajishlal

Hi @shiprasahu93

well noted.

I couldn't find any signature related Kraken Fileless attack but found some signature in GAV related about kraken.

shiprasahu93

@Ajishlal,

Yes, exactly. Me too. I have written to the concerned team to get confirmation on the same. I will let you know.

Thanks!

Ajishlal

Hi @shiprasahu93,
Well noted & thank for your support 🙏.
Best regards
Ajish