Email Malware Protection System

Stopping Spear Phishing Attacks To Prevent Malware-induced Data Theft
The FireEye Email Malware Protection System (MPS) protects organizations from targeted email attacks, often called spear phishing. Targeted email attacks are increasingly e¬ffective as more and more user-speci c information is publicly available on social networks and on the Internet. The savviest users can be fooled into clicking on a URL or opening up an attachment. Without the user taking any other action, the PC is then compromised and entered into the Modern Malware infection cycle. While antispam systems and gateway antivirus fi lter out nuisance emails and known malicious attachments, today’s spear phishing emails easily bypass their signatures, coarse grain heuristics, and reputation analyses. This exposes users to “drive-by downloads” of malicious code and malicious attachments like PDFs with embedded exploit code.

FireEye Email security appliances are designed support a range of organizations accomodating large, global enterprises as well as small and medium enterprises. FireEye offers several unique benefits:

• Real-time Email Attachment & URL analysis - evaluates email attachments for zero-hour malware using virtual machines that run a crossmatrix of operating systems and applications, such as various web browsers and plug-ins.

• Real-time detection of zero-hour, targeted attacks - The Malware-VM filter features a multi-phase analysis using aggressive capture heuristics and deterministic virtual machine confirmation to eliminate false positives

• Spear Phishing Attack Correlation Across Web & Email - The Email MPS is integrated with the FireEye Web MPS and CMS to o¬ffer security across Web and email attack vectors. In addition, the integration with the Web MPS and CMS enables attack correlation so that Web-based attacks can be traced back to the original spear phishing email.

Fire Malware Protection System

The FireEye File Malware Protection System (MPS) analyzes network file shares to detect and quarantine malware brought into the network through the Web, email, or other manual means, such as online file sharing. This halts the lateral spread of advanced malware that traditional and next-generation firewalls, IPS, AV, and gateways miss. Advanced targeted attacks use sophisticated malware and APT tactics, not only to penetrate defenses, but also to spread laterally and establish a long-term foothold in the network.

FireEye File MPS security appliances analyze file shares using the patented FireEye Virtual Execution (VX) engine that detects zero-day malicious code embedded in common file types. The File MPS performs recursive, scheduled, and on-demand scanning of accessible network file shares to identify and quarantine resident malware without impact to corporate productivity. This halts a key stage of the advanced attack lifecycle.

•    Protects file shares from hosting advanced malware – Appliance deploys in active quarantine (protection-mode) or analysis only (monitor-mode)

•    Supports multiple scan modes – Scans can be recursive, scheduled, and on-demand for CIFS-compatible file shares

•    Supports wide range of file types – Using the VX engine, it detects and stops advanced targeted attacks using malicious images, PDFs, Flash, or ZIP/RAR/TNEF archives

•    Supports YARA-based rules – Enables information security analysts to specify byte-level rules and quickly analyze objects for threats specific to the organization

•    Supports third party anti-virus and AV-Suite integration – Malicious objects that anti-virus can also identify can be linked to the deeper forensic information provided in the File MPS for more efficient incident response prioritization

•    Integrates with Web MPS, Email MPS, and MAS via CMS – All new malicious content uncovered using the File MPS can be pushed to the other MPS and MAS appliances for real-time protection against emerging attacks

Malware Analysis System

The FireEye Malware Analysis System (MAS) gives threat analysts hands-on control over powerful auto-configured test environments where they can safely execute and inspect advanced malware, zero-day, and targeted APT attacks embedded in common file formats, email attachments, and Web objects. With advanced instrumentation, the FireEye Virtual Execution (VX) environments provide forensic details on the exploit, such as the vulnerability exploited to create a buffer overflow condition, attempts to escalate privileges within Windows, and the callback coordinates used to exfiltrate data.

When threat analysts need a secure environment to test, replay, characterize, and document advanced malicious activities, they can simply load a suspicious file or set of files into the FireEye MAS' VX engine. As it analyzes files such as suspicious email attachments, PDF documents, or Web objects via a URL, the MAS reports a full 360-degree view of the attack, from the initial exploit and malware execution path to the callback destinations and follow-on binary download attempts.

•    Provides pre-configured sandbox or live-mode analysis for unknown code and suspicious Web objects – Supports single and batch testing with a range of browsers, plug-ins, applications and Windows operating environments, looking for any sign of unusual activity and any attempt to exploit a vulnerability

•    Automated or batched analysis of zero-day attacks – Using the VX engine, it detects and stops advanced targeted attacks using malicious images, PDFs, Flash, or ZIP/RAR/TNEF archives

•    Identifies outbound malware transmissions across multiple protocols – Shows how malicious code plans to steal data, control bot activities or communicate multistage operations using HTTP, FTP, or IRC, revealing the intent of the malicious software

•    Dynamically generates malware intelligence – Captures details such as callback coordinates and communication characteristics to protect locally and share globally through the cloud

•    Integrates with Web, Email, and File MPS via CMS – All new malicious content uncovered using the MAS can be pushed to the Web, Email, and File MPS for real-time protection against emerging attacks

•    Streamlines analysis – Lets analysts drill into samples to confirm attacks and understand the intent and targets of the criminals, without the overhead of creating and maintaining test configurations

•    Supports YARA-based rules – Enables information security analysts to specify byte-level rules and quickly analyze objects for threats specific to the organization

•    Supports third party anti-virus and AV-Suite integration – Malicious objects that anti-virus can also identify can be linked to the deeper forensic information provided in the MAS for more efficient incident response prioritization

Web Malware Protection System

Stopping Zero-day Attacks and Malware Callbacks To Inoculate Networks From Cyber Intrusions
FireEye Malware Protection System (MPS) network security appliances prevent signature-evading Modern Malware from successfully gaining a foothold in the network and exfiltrating sensitive organizational data. FireEye MPS appliances operate in-line, using fast-path blocking to stop known inbound attacks and malware callbacks coupled with dynamic, real-time Malware-VM™ and Malware-Callback™ analysis filters to accurately detect zero-hour attacks and halt their spread and negate their ability to steal data resources.

The MPS Series of Internet security gateways deploy within minutes in an organization's environment for malware analysis and threat prevention. Each appliance features a local graphical user interface management system, and can be optionally configured to connect to the FireEye Central Management System.

FireEye security appliances are designed support a range of network egress bandwidths accomodating large, global enterprises as well as small and medium enterprises. FireEye offers several unique benefits:

• Integrated Inbound & Outbound Blocking - Fast-path blocking of known attacks and malware callbacks is coupled with real-time Malware-VM and Malware-Callback analysis filters

• Real-time detection of zero-hour, targeted attacks - The Malware-VM filter features a multi-phase analysis using aggressive capture heuristics and deterministic virtual machine confirmation to eliminate false positives

• Outbound callback blocking - The Malware-Callback filter uses fine-grained, local and global malware intelligence to terminate data theft transmissions

• Multi-protocol protection - By analyzing traffic across protocols, FireEye can disrupt sophisticated malware, like Trojans, bots, worms, and rootkits, during all stages of the infection lifecycle: Initial exploit, Payload staging and installation, Network and System reconnaissance, and Data exfiltration.