Raspberry Robin, a new worm exploiting windows endpoints is here. The report reads: "Raspberry Robin is spreading to new Windows systems via infected USB drives containing a malicious .LNK file. Once the USB device is attached and the user clicks the link, the worm spawns a msiexec process using cmd.exe to launch a malicious file stored on the infected drive. It infects new Windows devices, communicates with its command and control servers (C2), and executes malicious payloads using several legitimate Windows utilities: 1. fodhelper (a trusted binary for managing features in Windows settings), 2. msiexec (command line Windows Installer component), 3. and odbcconf (a tool for configuring ODBC drivers)."   Link to the full report:   https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/microsoft-finds-raspberry-robin-worm-in-hundreds-of-windows-networks/amp/ View More

Hi colleagues,   Are there any frameworked recommendations for endpoint (host-based) firewall rules for end-user workstations?  I understand my request may result in varying opinions...and that's ok. 🙂 I also know that I will need to review the existing buisness-sanctioned connections to ensure I don't break anything that the bsuiness needs to operate.  Thanks in advance for any advice, links to frameworks that provide specific guidance etc. View More