TIE POC Guide Final
Contents
Installation and Configuration Checklist
Content – Testing with benign samples
Immediate Visibility– Gain insight into executables & certificates run in your environment
The TIE Client – A new kind of protection against emerging threats
Control – Take immediate action
Speed and Distribution – It’s fast
Incident Response – Patient Zero & Clean Up
McAfee Advanced Threat Defense for Automated Intelligence
Introduction
McAfee® Threat Intelligence Exchange provides adaptive prevention for emerging threats. It quickly analyzes files and content in your environment and makes informed security decisions based on a file's reputation and your specific criteria to determine if there is a threat to your environment.
The challenge in today's network environment is the growing number of devices and systems on a network, and their inability to communicate security information with each other. Until now, they have acted as separate silos and could not be intelligently managed as a whole.
Threat Intelligence Exchange changes that. Imagine knowing exactly which machines have been compromised by a specific file, and then acting immediately to prevent the threat from spreading throughout your environment, even to remote networks and systems. You can see exactly on which system the threat was first seen and where it went from there, and stop it immediately across your entire environment.
Threat Intelligence Exchange provides the latest technology in detecting and preventing threats:
- A security ecosystem that allows instant communication between endpoints, systems, and devices in your environment. They send information to the Threat Intelligence Exchange server where it is then available to endpoints throughout your environment.
- A new kind of endpoint protection that evaluates local, global and enterprise level intelligence to make smart execution time decisions to allow or block executables.
- Faster detection and protection against security threats and malware.
- The ability to immediately block or allow specific files and certificates based on their threat reputations.
For more information on Threat Intelligence Exchange visit our webpage at http://www.mcafee.com/us/products/threat-intelligence-exchange.aspx
Purpose
This guide is intended to assist with the setup, configuration, and use of McAfee’s Threat Intelligence Exchange (TIE) and Data Exchange Layer (DXL) version 1.0 for testing, evaluation or Proof-of-Concept (POC). This guide will walk you through the pre-requisites, installation, deployment, configuration and most common scenarios used for testing and getting the most value from TIE and DXL in your environment. The use cases were designed to demonstrate the most common issues TIE solves at the near real-time speed DXL offers.
Deployment Requirements
McAfee Threat Intelligence Exchange is made up of four major mandatory components, and a number of smaller optional pieces. The mandatory components are:
ePO Server
- ePO Server is the centralized management system where all configuration, deployment, configuration, management and reporting occurs. This server may run on Windows Server 2008 R2 or greater. Both Physical and Virtual is supported.
TIE Server
- The Threat Intelligence Exchange server stores file and certificate reputation information. It then communicates that information to other systems and endpoints in your environment as needed. The benefit of context-aware security is the ability to gather situational and environmental information at the moment the system is running. The information is then used to communicate and share file and certificate reputation information to make real-time, accurate security decisions.
Data-exchange layer (DXL)
- The data-exchange layer (DXL) allows bidirectional communication between endpoints on a network. Threat information can be shared immediately with all other services and devices on the network, reducing the spread of threats.
- DXL, together with Threat Intelligence Exchange, shares reputation information between multiple endpoints, regardless of their location. DXL works in the background, communicating with services, databases, endpoints, and applications. It receives and sends encrypted messages about file metadata throughout your environment to track activity, risks, and threats in real time. Sharing reputation information as soon as it becomes available reduces the assumptions that applications and services make about each other when exchanging information.
TIE/DXL Client (Endpoint)
- Agent module that quickly analyzes files and content in your environment and makes informed security decisions based on a file's reputation, local, global and enterprise context and your specific policy to determine if there is a threat to your environment. The TIE Client requires the McAfee Agent and VSE to be installed.
For a more detailed description of each of the key components please refer to the product guide.
Optional Components
There are additional components such as Advanced Threat Defense which add value to the TIE solution that are optional, but may be required for successful completion of an evaluation. As products are integrated into the DXL the possibilities greatly increase. Supplemental documentation on optional components and additional products can be found at in the appendix of this POC Guide.
ATD
- If a file's reputation is unknown or is not certain, you can submit it to Advanced Threat Defense for further analysis. Advanced Threat Defense is purchased separately and detects zero-day malware and combines anti-virus signatures, reputation, and real-time emulation defenses. Files can be sent from Threat Intelligence Exchange to Advanced Threat Defense automatically based on their reputation level and file size. For additional information on ATD please take a look at our product page http://www.mcafee.com/us/products/advanced-threat-defense.aspx
VirusTotal API Key
- VirusTotal is a free service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware. For additional information on Virus Total see https://www.virustotal.com/
Requirements/Pre-Requisites
In order to successfully deploy the McAfee TIE solution for evaluation, the following is required:
McAfee software
- ePO 5.1.1 or later running on Windows Server 2008 R2 or later
- McAfee Agent 5.0 or later installed on endpoints
- VSE 8.8 with patch 4 hotfix 929019 installed on endpoints
Customer provided
- VMware / ESXi server for hosting the TIE/DXL server
- Network requirements
IP Address for:
- TIE/DXL Server
Ports:
- ePO Ports (Default TCP 80, 443, 8081, 8443, 8444, 1433 UDP 8082, 1434) For more detailed information see (KB66797)
- TIE Server/DXL Ports (Default 8883, 1883)
- Postgres (TCP and UDP 5432)
- Private API Key from VirusTotal (See appendix for instructions on obtaining this)
- 2 or more Endpoints:
You can install Threat Intelligence Exchange Client on the following operating systems.
Microsoft Windows Windows 7 (32 and 64 bit)
Windows 8.0 (32 and 64 bit)
Windows 8.1 (32 and 64 bit)
Windows 8.1U1/U2 (32 and 64 bit)
Windows Server 2008 R2
Windows Server 2012/2012 R2
**It is more accurate and interesting in a POC to use a typical system in your environment for testing. If a live production system is not available we suggest using VMware physical to virtual conversion to make a copy of a production system. For additional information regarding vCenter Converter see http://www.vmware.com/products/converter/features
Installation and Configuration Checklist
The TIE Installation Guide can be found on the McAfee download site with a valid grant number. The installation is fairly quick however the following steps should be performed in order. This checklist is provided as a reference to give you a forward look at what steps will be performed as well as a reference to how far along in the install process you are.
Pre-requisites (need to be installed prior to following the installation steps of this guide)
- Install ePO 5.1.1
- Install McAfee Agent 5.0 on 2 or more endpoints
- Check in package MA‑WIN 5.0.0 Build XXXX Package #x (ENU‑LICENSED‑Release‑MAIN)
- Install extension EPOAGENTMETA.zip
- Check in package MA‑WIN 5.0.0 Build XXXX Package #x (ENU‑LICENSED‑Release‑MAIN)
- Install and deploy the VSE client to your endpoints
- Check the following files into the software repository:
- Check the following files into the software repository:
- VSE 8.8.0 Build xxxx Package #x (AAA‑LICENSED‑RELEASE‑PATCH 4)
- VSE 8.8.0 Build xxxx Package #x (AAA‑LICENSED‑RELEASE‑HOTFIX 929019)
- Install extension VSE 8.8.0 Build xxxx Package #x (AAA‑LICENSED‑RELEASE‑PATCH 4)
- Deploy VSE to the Client systems
- Create a client task to apply VSE hotfix
POC Guide starts here:
- Install TIE/DXL extensions in ePO
- DXLBrokerMgmt_1.0.0_Build_xxxx Package #x (ENU‑LICENSED‑RELEASE‑MAIN).zip
- DXLClient_1.0.0_Build_xxxxPackage #x (ENU‑LICENSED‑RELEASE‑MAIN).zip
- DXLClientMgmt_1.0.0_Build_xxxx Package #x (ENU‑LICENSED‑RELEASE‑MAIN).zip
- TIEServerMgmt_1.0.0_Build_xxx Package #x (ENU‑LICENSED‑RELEASE‑MAIN).zip
- TIEmMeta.zip
- DXLBrokerMgmt_1.0.0_Build_xxxx Package #x (ENU‑LICENSED‑RELEASE‑MAIN).zip
- Check in DXL Client Package DXL 1.0.0 Build xxx Package #x (ENU‑LICENSED‑RELEASE‑MAIN)
- Check in JTICAgent.zip
- Deploy the TIE/DXL Virtual Server on ESXi server using TIEServer_1.0.0.xxx.x86_64‑MAIN.ova
- Complete TIE/DXL server installation
- Create a new Registered Server in ePO for the TIE postgres database
- Deploy DXL Client using ePO product deployment
- Deploy TIE Client using ePO product deployment
- Verify the installation
- DXL Broker, DXL Client and TIE server visible in the system tree
- DXL Client connection state = connected
- TIE Server connection state = connected
- A wildcard search for TIE file or cert reputation returns data (Note: you may have to execute a few samples on the endpoint to see data in the TIE reputations page)
- DXL Broker, DXL Client and TIE server visible in the system tree
- Configure TIE server extension in ePO
- Add Virus Total API Key to Server Settings
- In the Policy Catalog configure GTI, Telemetry, and ATD settings
- Add Virus Total API Key to Server Settings
- Configure DXL Broker in ePO server settings
Installation and Configuration of McAfee Threat Intelligence Exchange (TIE) and Data Exchange Layer (DXL)
Most of the TIE/DXL installation and configuration can be completed by the customer prior to arriving on site. If these items are done prior to arriving on site this can help ensure a successful evaluation with data points to work from.
The installation and configuration assumes:
- ePO 5.1.1 is installed and configured
- McAfee Agent 5.0 and VSE 8.8 patch 4 with hotfix 929019 are installed and deployed on the endpoints
- ESXi server is accessible for OVA deployment
This section is comprised of 3 main steps:
Installing the TIE/DXL server
VM Specifications for the TIE/DXL server:
The TIE/DXL server is deployed as a Virtual Server. Ensure the virtual machine has the following hardware specifications. For the purposes of POC, we assume the TIE server and DXL broker will be installed on the same server:
- VMWare ESXi 5.1.0 and above
- The OVA (VMWare image) is pre-configured with 16GB of RAM and 8 CPU’s. The ESXi server must be able to handle this configuration.
- Sufficient SSD or hard disk for the database (116 GB when thick provisioned)
**The TIE/DXL server is a single McAfee provided OVA file that includes both components.
Other considerations:
- Determine the IP address to be used during the POC. Both Manual and DHCP options are available.
- Determine the IP address and administrator username and password of the ePO server that TIE/DXL will be connecting to.
For a quick video demonstration of the TIE/DXL server deploy and installation go to: https://mcafee.box.com/s/sie74ncenw9nqo92tbiy
These steps will walk you through downloading, installing and configuring the McAfee Threat Intelligence Exchange and Data Exchange Layer Server:
Step | Instructions | Image or amplifying instructions. |
1. | Upon receiving your grant number access the software download portal from the following link | |
2. | Enter your grant number under Download My Products and Click Go | |
3. | Under Software downloads click on “McAfee Threat Intelligence Exchange” Note: These extensions and packages are also available in the ePO Software Manager | Download TIE_Server_1.0.0.xxx.x86_64-MAIN.ova Note: The VMWare vSphere client will need access to this file Download the following extensions and packages from the McAfee download site or check in from the Software Manager in ePO:
|
4. | In ePO, install the following extensions: DXLBrokerMgmt_1.0.0_Build_xxxx Package #x.zip DXLClient_1.0.0_Build_xxxx Package #x.zip DXLClientMgmt_1.0.0_Build_xxxx Package #x.zip help_dxl_100.zip TIEServerMgmt_1.0.0_Build_xxx Package #x.zip help_tie_100.zip TIEmMeta.zip help_jtic_100.zip Select Menu | Software | Extensions and then click Install Extension Repeat this process until all 5 extensions and 3 help files are checked in. When all extensions are properly installed you should see: McAfee DXL McAfee TIE Server Threat Intelligence Exchange module for VSE | |
5. | Check the DXL and TIE package into the Master Repository Select Menu| Software | Master Repository and then click Check In Package Browse to DXL 1.0.0 Build xxx Package #x.zip Click Next and Save Repeat these steps for the JTICAgent.zip The Master Repository should appear as follows | |
6. | Once the product extension and packages are properly checked in to ePO, you are ready to install the TIE/DXL Server. Open the VMware vSphere Client. Select File | Deploy OVF Template | |
7. | Browse to the location of the TIEServer_1.0.0.xxx.x86_64‑MAIN.ova file on your computer, and then click Next. Complete the steps in the wizard, accepting the default values. | |
8. | The first time you power on the virtual machine and open the console you will see the following End User Agreement License. Click enter several times and Y to accept and begin the installation. | |
9. | Create a root password for the Threat Intelligence Exchange virtual server. The password must be at least nine characters. Press Y to create. | |
9. | The operational account will have limited permissions. Enter an Account Name, Real Name, and Password. Use the Tab key to move to the next field. When finished, press Y to continue. | |
10. | Only one option appears on this page, enter N to continue. *Note: N is the only option to move forward. When only 1 option is present tab or enter will not work. | |
11. | Select DHCP or Manual IP address configuration. Enter D for DHCP or M for Manual. If you select Manual, enter the remaining information. When finished, enter Y to continue. | |
12. | Enter the Hostname and Domain Name (if appropriate) of the computer where you are installing the Threat Intelligence Exchange server appliance. Enter Y to continue. | |
13. | Enter up to three Time Servers to synchronize the time of the Threat Intelligence Exchange server. Use the default servers listed, or enter the address for up to three servers. Enter Y to continue. | |
14. | Enter the IP Address or fully qualified domain name, port, and account information for your McAfee ePO server. Enter Y to continue. Note: The ePO server must be available. At this point the installation will begin to configure the McAfee Agent. | |
15. | Enter the ePO Agent Wake-up Port. The default is 8081. Enter Y to continue. | |
16. | Select the services to run on the Threat Intelligence Exchange server. Enter Y for both DXL Broker, and TIE Server. Enter Y to continue. | |
17. | A Master server replicates the Threat Intelligence Exchange database to all Slave servers, if you have them. Enter M for configuration. Enter Y to continue. Note: For the POC only install a Master | |
18. | The Read-Only Account enables McAfee ePO to communicate with the Threat Intelligence Exchange server postgres database. You will enter this information in the ePO Registered Servers in a later step to allow ePO to connect to and receive data from the TIE server database. Enter the Read-Only Account Name and the Password. Enter Y to continue. | |
19. | Specify the DXL Broker Port that the Data Exchange Layer uses. Use the default port 8883, or enter a port number within the range shown. Enter Y to continue. | |
20. | Do nothing on this page. TIE Server setup is complete. | |
21. | To view TIE database information in McAfee ePO reports and dashboards, create a new registered server. In McAfee ePO, click Menu | Configuration | Registered Servers, then click New Server. In the Server type drop-down list, click Database Server. Enter a Name, for example, TIE Database, and then click Next. | |
22. | Select the checkbox for Make this the default database for the selected database type. Database Vendor: select TieServerPostgres. Host name or IP address: enter the host name of the system where you installed the TIE server. **If you use the host name, make sure it’s registered in DNS. Since the TIE Server is Linux, it doesn’t automatically get registered into DNS upon creation Database name: enter tie. **This is case sensitive User name and password: enter the read-only postgres user name and password you specified on the PosgreSQL Read-Only Account Setup page during the TIE server installation. Click Test Connection to verify the connection information and user credentials. | |
23. | To verify that the TIE/DXL server is installed and communicating properly, open the System Tree in ePO. The TIE Server is listed as a managed system. Note: You may have to change the Preset field to This Group and All Subgroups to see the TIE Server entry. | |
24. | Click the TIE server name, then click the Products tab. Verify that the following products are listed: • Agent • McAfee DXL Broker • McAfee DXL Client • McAfee Threat Intelligence Exchange Server You may have to wait for 2 ASCIs for all components to install and check in properly. Doing an Agent Wake-Up Call with Force complete policy and task update checked can speed up this process. | |
25. | Click the DXL Status tab to verify the TIE Server is connected. | |
26. | Click Actions | DXL | Lookup in DXL You should see the TIE server is Connected |
Installing and verifying the DXL client and McAfee Threat Intelligence Exchange Module for VSE on your endpoint
Prerequisites for the TIE Client:
- McAfee Agent 5.0
- Virus Scan 8.8 patch 4 with hotfix 929019
These steps will walk you through installing and verifying the DXL client and McAfee Threat Intelligence Exchange module for VSE:
Step | Instructions | Image or amplifying instructions. |
1. | Prior to deploying the DXL and TIE Client verify McAfee Agent 5.0 and VSE 8.8.0.1263 are installed on your endpoint. Click into the endpoint in the System Tree and click the Products tab. | |
2. | In McAfee ePO, click Menu | Software | Product Deployment, then click New Deployment. | |
3. | Name the deployment DXL For Type select Fixed Choose Data Exchange Layer Client 1.0.0 package. Note: This is the same package that was checked into the master repository in the beginning of the installation section. | |
4. | Click Select Systems The System Selection screen will pop up. Select only the endpoints you wish to deploy the DXL client to. Note: Do not deploy the DXL client to the TIE Sever. When the endpoints are selected Click OK | |
5. | To complete the Product Deployment form select Run Immediately | |
6. | At the top of the Product Deployment page click Save to begin deployment | |
7. | Once the product deployment page shows successful completion of DXL on your endpoint, verify McAfee DXL Client appears in the Products tab of your system. In McAfee ePO, click Menu | System Tree Click the endpoint and click the Products tab Note: You may have to wait for 2 ASCIs for all components to install and check in properly. Doing an Agent Wake-Up Call with Force complete policy and task update checked can speed up this process. | |
8. | Repeat the same Product Deployment process for the TIE Module for VSE. In McAfee ePO, click Menu | Software | Product Deployment, then click New Deployment. | |
9. | Name the deployment TIE For Type select Fixed Choose the Threat Intelligence Exchange module for VirusScan Enterprise 1.0.0 package. Note: This is the same package that was checked into the master repository in the beginning of the installation section. | |
10. | Click Select Systems The System Selection screen will pop up. Select only the endpoints you wish to deploy the TIE module to. Note: Do not deploy the TIE Module to the TIE Sever. When the endpoints are selected Click OK | |
11. | To complete the Product Deployment form select Run Immediately | |
12. | At the top of the Product Deployment page click Save to begin deployment | |
13. | Verify the Product deployment page shows successful completion of TIE on your endpoint. Note: You may have to wait for 2 ASCIs for all components to install and check in properly. Doing an Agent Wake-Up Call with ‘Force complete policy and task update’ checked can speed up this process. | |
14. | Click into the endpoint in the System Tree and click the Products tab to verify the Threat Intelligence Exchange module for VSE installation was successful. | |
15. | Click the DXL Status tab to verify the client is Connected. | |
16. | Click Actions | DXL | Lookup in DXL You should see the endpoint is Connected |
Configuring the TIE Solution
Prerequisites
Before completing this section you must have completed the server and client installation sections. The policies set in this section must be mirrored in order for the use cases in the next section to perform as documented.
Considerations
For the POC we will be setting the client policy to block at ‘Unknown’. In order to demonstrate the capabilities without compromising safety, the files used in the sample set are benign. In production, it would be more common that blocking will be set to ‘Might be Malicious’. See below for recommendations:
Block at Unknown: Point of Sale devices, Production Servers where little to no changes occur
Might be Malicious: Most endpoints would fall into this category (**depending on risk tolerance of your organization)
Observe mode: Run in observe mode to establish a system baseline and to populate the TIE server with commonly used files. Once the system policy is changed to enforce the files that were already evaluated in observe mode would not be considered new to your environment.
TIE Scanning tool: The TIE Scan tool performs TIE analysis on user-specified files and folders, and populates a TIE server database with baseline data from a gold image. The TIE Scanning tool is not an official part of the product and comes with minimal/no support or documentation. Please refer to the Baseline Gold Images with the TIE Scanner section of the appendix for more information.
These steps will walk you through TIE server and client extension configuration as needed for the user story section:
Step | Instructions | Image or amplifying instructions. |
1. | Configure the TIE Server Extension under Menu | Configuration | Server Settings | Threat Intelligence Exchange Server Click Edit. | |
2. | Enter your VirusTotal Public/Private Key. Click Save. **For more information on how to obtain the VirusTotal Public/Private Key see appendix | |
3. | To access the TIE Server settings policy, select Menu | Policy | Policy Catalog and select McAfee TIE Server Management 1.0.0 in the Product dropdown. Click into My Default to edit. | |
4. | On the General tab, you can enable and disable GTI Reputations and set Proxy and Product Improvement Program settings. For this POC guide to perform as documented GTI reputations must be Enabled Note: The Product Improvement Program helps McAfee learn about threats and prioritize what is allowed or blocked. | |
5. | ||
6. | To access the TIE Client policy, select Menu | Policy | Policy Catalog and select Threat Intelligence Exchange Module for VSE 1.0.0 in the Product dropdown. Click My Default to configure. | |
7. | Configure your Client policy. Leave Self Protection Enabled Self Protection: If selected, prevents users on managed endpoints from changing Threat Intelligence Exchange module settings. | |
8. | Set Operation Mode to Enforce Operation Mode: Specifies whether the module applies the policy settings on this page. | |
9. | Check Enable or not depending on your preference. For the POC it does not matter which is chosen. | |
10. | Set Balance Security for Typical systems Balance Security For: There are three levels that reflect the amount of risk, or security, allowed on the systems that use this policy. | |
11. | Set Clean at: Known Malicious Set Block at: Unknown Reputation Responses for Executables, DLLs, Drivers: Specify what happens when a file with a specific reputation level tries to run on a system that uses this policy. | |
12. | Leave End User Prompting disabled for the POC | |
13. | Check Enable or not depending on your preference. For the POC it does not matter which is chosen. | |
14. | If ATD is being used and configured in the TIE Server extension, check submit files to ATD at Unknown. This step is not required if ATD is not included in the POC. |
Content – Testing with benign samples
Being able to demonstrate the power of Threat Intelligence Exchange without risking malware execution can be difficult. Below you will find tips, tools and a list of benign samples used to demonstrate the TIE solution.
Tips
Be cautious when extracting the test files. The test files are benign however the reputations are set to various levels in GTI. Virus Scan will happily delete them for you if you aren't careful. This could result in a polite but fairly stern email from your friendly Security team.
Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled.
Tools
Hash tool - Determining the hash of a file allows the administrator to import a reputation before the file ever enters the environment. Hash tool: http://www.keir.net/hash.html
Hex Editor - A hex editor allows a file to be modified enough to change the hash of the file. When testing samples that are already known trusted, hex editing is a good way to create a new sample. Hex editor: http://download.cnet.com/HxD-Hex-Editor/3000-2352_4-10891068.html
Samples
Instructions & Samples: http://mcaf.ee/yiuva
- Artemis-High.exe: Hardcoded reputation of Might be Malicious.
- Roaming.exe: Triggers a TIE rule when executed from the $AppData$\Roaming directory
- Artemis-Unknown-All.exe: Hardcoded reputation of Unknown
- Morph.exe: GTI Known Trusted, ATD Most Likely Malicious. Hash below for reputation import:
SHA-1 Hash: 0x13ECDDA4F45CD028221AF300EEBB207B60CB5C6C
MD5 Hash: 0xFB36DE68696BC60D9A51B537F97BDAD3
- Hackit.exe: Visual executable used in demonstrating zero day attacks and the kill process. Included in the zip and can also be found at http://hack-it.en.softonic.com/
- Wireshark.exe: Good tool for testing certificate reputation. Download from https://www.wireshark.org/download.html
User Stories
The user story section is designed to demonstrate the most common use cases for the TIE solution. This section does not include all TIE features and functionality. The following use cases were designed to be performed in the order documented:
Immediate Visibility – Gain insight into new executables and certificates running in your environment
The TIE Client – A new kind of protection against emerging threats
Control – Take immediate action
Speed and Distribution – It’s fast
Incident Response – Patient Zero & Clean Up
Immediate Visibility– Gain insight into executables & certificates run in your environment
McAfee Threat Intelligence Exchange brings immediate visibility into the presence of advanced targeted attacks and emerging threats by automatically assembling events and valuable context as communicated from the new intelligence based endpoint client, gateways, and other connected security components.
Pain point | McAfee Capability to Solve the Pain |
Fragmented visibility – limited or no understanding of what files are running on endpoints | TIE baselines and shows you what is actually running in the environment. TIE synthesizes attack insights into actionable intelligence, such as first contact, local prevalence, file trajectory, and infection artifacts that help guide investigations and timelines. |
Increasing complexity – too many siloed technologies | TIE transforms disparate security components to create a single collaborative system that instantly shares contextual insights while delivering immediate adaptive threat protection. |
Pre-requisites:
- Download the set of test samples provided here: http://mcaf.ee/yiuva
- For this use case we will be using Artemis-High.exe
Objective
The objective of this use case is to demonstrate the ability to identify new executables and certificates that are being run in your environment using McAfee Threat Intelligence Exchange. Successful completion of this use case demonstrates the added visibility and information that the TIE solution offers.
Step | Instructions | Image or amplifying instructions. |
1. | Login to ePO | |
2. | Click on Menu | Systems Section | TIE Reputations | |
3. | In the File Search tab Enter * in the search field and click Find Files. *Note hitting enter will not search. You must use the mouse to click the Find Files button. | |
4. | You will see a list of files that have been executed on your endpoints. You may need to execute a few files before this page is populated. Each column can be clicked to sort the information including ATD reputation, comments, hashes etc. Clicking to sort by GTI reputation will highlight some of the more interesting files being executed. | |
5. | File details can be added to the initial search results by clicking Actions | Choose Columns Add columns as desired. In the case where ATD is being used, add the ATD column for added reputation information. | |
6. | On the endpoint run the Artemis-High.exe provided in the test samples. The file execution will be blocked. | |
7. | In the TIE Reputations page search for artemis You will see the file was blocked based off of its GTI reputation ‘Might be Malicious’. Click Artemis-High.exe to research additional information about the executable. | |
8. | The File Details tab provides additional information about the file properties. | |
9. | The Additional Information tab includes data collected from the first system to execute the file. This includes:
| |
10. | The Virus Total tab allows the user to cross reference the file against VirusTotal. Click Retrieve VirusTotal Information. Note: You must configure your VirusTotal API Key for this to work. See the VirusTotal section of Appendix for details. | |
11. | The same steps apply to Certificates. In the TIE Reputations page of ePO go to the Certificate Search tab and enter * in the search field and click Find Certificates. *Note hitting enter will not search. You must use the mouse to click the Find Files button. | |
12. | In this case Dropbox had been run. You will have several certificates to research. Microsoft is a very common one. Click into a certificate to research additional information. | |
13. | In order to help separate real enterprise threats from general background noise in the environment, the TIE Server Dashboard focuses in on new and notable information. | |
14. | New files by GTI reputation — Shows new executable files by McAfee GTI reputation that attempted to run in your environment in the past week. This report is especially useful to quickly see the new files that were malicious or unknown in your environment. Clicking into the Not Set portion of the graph narrows the files that GTI does not have a reputation for. This makes it easy for an admin to determine where to investigate first. | |
15. | New files in the past 30 days — Shows new executable files that attempted to run in your environment in the past 30 days. Once TIE has been running in your environment for a few days you will start to only see spikes when there is a possible reason for concern. Clicking into a data point will show new files by day. | |
16. | Files with changed GTI reputations — Shows files whose reputations were changed in McAfee GTI in the past month. On further research or new information received, McAfee may determine a reputation change is needed. The administrator may want to investigate enterprise overrides further if the GTI reputation has changed. | |
17. | Systems with new executable files — Shows the top 10 systems that had the most new executable files attempting to run. This report shows systems that are potentially at risk for new infections because they are accessing the most new executables. A high new file count in on unexpected system such as a POS device or production server might alarm the administrator of suspicious behavior. | |
18. | Quick file search — Allows you to search for a specific file string or hash. Partial entries will search for all occurrences. Any news alert or notification of compromise can be searched. This is a quick place to easily research a specific file or hash (also good place to research results even from another security product). |
Conclusion
By working through this use case you are now aware of the immediate visibility that the TIE solution offers. You can now answer critical security questions:
- What is running in my environment?
- Where is it running?
- When did it run?
- Has my environment seen specific malware? Or a recent zero day attack?
- Which systems are at most risk from new executables?
- Are there systems with unanticipated change?
The TIE Client – A new kind of protection against emerging threats
Now that you are fully aware of the files and associated certificates running in your environment and have been able to explore where possible compromises and threats are occurring let’s take a look at the benefits of the TIE Client.
Pain point | McAfee Capability to Solve the Pain |
Ineffective protection | TIE provides organizations with immediate visibility and protection from attacks. Threats are stopped. |
The TIE Client makes accurate file execution decisions and leverages the combined intelligence from local endpoint context (file, process, and environmental attributes) and the current available collective threat intelligence (for example, organizational prevalence, age, reputation, etc.). When you customize the McAfee Threat Intelligence Exchange VirusScan Enterprise Module based on your organization’s level of risk tolerance at the endpoint, administrators get the flexibility to set execution conditions driven by their specific requirements. This can be as rigid as adhering to a zero-tolerance policy for unknown or ‘grey’ files by setting rules that no file is allowed to execute unless it has a known and acceptable reputation.
Pre-requisites:
- Sample file Roaming.exe and Hackit.exe
Objective
The objective of this use case is to demonstrate the power of the TIE Client for zero day threats. Successful completion of this use case should demonstrate the added intelligence that the TIE client offers.
Step | Instructions | Image or amplifying instructions. |
1. | Based on our research we know that malware tends to hide itself in specific folders. In this use case we will explore the root of $appdata$\roaming as an indicator of risky behavior. On the endpoint in explorer navigate to C:\ and select Organize | Folder and Search Options. On the View tab click Show hidden files, folders, and drives | |
2. | On your endpoint move the sample file Roaming.exe to C:\Users\<user>\AppData\Roaming Execute Roaming.exe from this folder. | |
3. | The TIE Client rules will block the file from being executed and expose the context as to which rule was triggered under Convicting Rule In this case ‘Identified suspicious files executing from the roaming folder’ Note: Running from the recycle bin is another good example of a risky behavior we use to help detect malware | |
4. | To view the added value of the TIE rules across your entire environment select the Dashboard – TIE module for VSE enforced events. Click into Block Events by Event Type | |
5. | The Rule Name exposes the added value of the TIE Client by explaining the specific rule that was triggered. Click on Roaming.exe to view additional information on the block. | |
6. | To view the TIE rules in more detail go to Menu | Configuration | Server Settings Click Threat Intelligence Exchange Module for VSE | |
7. | Click Edit to view the rule details. To change the rule mode click the checkbox next to a rule and click Actions |
Additional bonus exercise: To demonstrate TIE’s ability to catch all zero day attacks even further, you may want to manipulate a known file to see what happens.
Pre-requisites:
- A hex editor such as HxD (can be downloaded from here http://hxd-hex-editor.soft32.com/)
- Hackit.exe
8. | Remote Desktop into the client system and run Hackit.exe. Based on the GTI Known Trusted reputation the file will be allowed to run. |
9. | Right click the Hackit icon in the system tray and click Shutdown Hack-it |
10. | Open Hackit.exe in your hex editor. Edit something minor such as the text ‘This program cannot be run in DOS mode’ to a different string. You only need to change it enough to change the file hash. Save As a new file name. |
11. | Execute the new file and view the block. Researching the block in the ePO console you will see it is no longer allowed to run based on GTI reputation as it was in our previous step. File execution is blocked based on its unknown reputation. |
Conclusion
The added enterprise, global and local context allow the TIE client to apply a set of rules that indicate risky behavior. As seen in this use case a file that is unknown in your environment with no confirmed good reputation is automatically blocked immunizing your enterprise from targeted attacks.
Control – Take immediate action
Now that you have complete visibility of your environment and endpoint protection that takes local, enterprise and global context into account when determining risky behavior let’s take action and apply our new Threat Intelligence to make smarter security decisions.
Pain point | McAfee Capability to Solve the Pain |
Lack of control – cannot identify or take actions on the unknown | TIE filters out the threat “signal” from the “background noise” of events in order to identify and control suspicious objects |
McAfee Threat Intelligence Exchange makes it possible for administrators to easily tailor comprehensive threat intelligence from global intelligence data sources. These can be McAfee Global Threat Intelligence (McAfee GTI) or third-party feeds, with local threat intelligence sourced from real-time and historical event data delivered via endpoints, gateways, and other security components. Customers are empowered to assemble, override, augment, and tune the intelligence source information so that they can customize data for their environment and organization (for example, blacklists and whitelists of files and certificates or certificates assigned to and used by the organization).
Pre-requisites:
- For this use case we will be using Artemis-Unknown-AllSL.exe and Morph.exe
- Wireshark installed on the endpoint (for certificate based blocking) https://www.wireshark.org/download.html
Objective
The objective of this use case is to demonstrate the informed control that we are giving to the administrator. Successful completion of this use case will demonstrate the added control that TIE & DXL offers against current and future threats.
Step | Instructions | Image or amplifying instructions. |
1. | Click on Menu | Systems Section | TIE Reputations | |
2. | In the File Search tab enter Artemis-Unknown in the search field and click Find Files. You will not find any results since the file has not been run. | |
3. | Log in to the Client system and attempt to run Artemis-Unknown-AllSL.exe. You will not be able to execute this file as it is unknown and without a reputation. | |
4. | For this demo, let’s pretend that you have researched Artemis-Unknown-AllSL.exe further and decided it is not malicious. If you would like it to be allowed to run in your environment, you need to override its current reputation. In the File Search tab enter Artemis-Unknown in the search field a second time and click Find Files. Click the checkbox next to Artemis-Unknown-AllSL.exe and click Actions | |
5. | Mark Artemis-Unknown-AllSL.exe as File Known Trusted. Note: Setting the reputation to Most Likely Trusted will also work This sets the Enterprise Reputation which overrides the current block based on unknown. | |
6. | You will be prompted to Add Comment Click OK | |
7. | Log in to the Client system and attempt to run Artemis-Unknown-AllSL.exe. You will now be able to execute this file. | |
8. | Let’s now pretend that you have discovered several different Wireshark versions in your environment, some of which are being used to capture network traffic that you are concerned might be for malicious intent. Download, Install and Run Wireshark on your endpoint as instructed on wireshark.org | |
9. | To prevent all tools signed with this certificate from executing you would like to block all executables that are signed by the Wireshark certificate. To do this you need to set its reputation at the enterprise level. In ePO go to TIE Reputations | Certificate Search tab Enter Wire in the search field and click Find Certificates. Click the checkbox next to the Wireshark Certificate and click Actions and set the certificate to Most Likely Malicious | |
10. | You will be prompted to Add Comment Click OK | |
11. | Any file signed with the Wireshark certificate will be blocked from executing immediately. Note: The reputation update happens immediately and does not require the McAfee Agent to wait for an Agent to Server Communication Interval (ASCI). | |
12. | You also have the ability to immunize your environment before a threat occurs. You can get this intelligence from third party threat feeds, the media, or other security products. Click on Menu | Systems Section | TIE Reputations | File Overrides Click Actions | Import Reputations | |
13. | Enter Filename: MORPH.EXE SHA-1 Hash: 0x13ECDDA4F45CD028221AF300EEBB207B60CB5C6C MD5 Hash: 0xFB36DE68696BC60D9A51B537F97BDAD3 Set to Most Likely Malicious Click OK and OK on the confirmation screen **Reputations can also be imported via xml or ePO API | |
14. | Log in to the Client system and attempt to run Morph.exe. The file is blocked immediately because we set its reputation to Most Likely Malicious in the previous step. This reputation was immediately known by the endpoint because TIE and the DXL operate in real time. | |
15. | Click Menu | Reporting | TIE Module for VSE Events for additional event details For Example: Select Pivot Point: Pivot by Rule to view the number of blocks based on specific TIE Rules. These events were generated as part of the TIE Client use case. |
Conclusion
The TIE solution gives the administrator immediate control over files and associated certificates executing in their environment as well as the ability to immunize the enterprise with imported threat intelligence.
Speed and Distribution – It’s fast
You may have already noticed this added visibility and control is fast. Threat details collected from malware encountered at endpoints and network gateways can propagate through the data exchange layer in milliseconds, educating all security components to proactively immunize against newly detected threats.
Pain point | McAfee Capability to Solve the Pain |
Slow response – dependent on vendor signatures and content updates | Reputation changes are instantly published to all of TIE-enabled network, gateway, and endpoint components without requiring traditional DAT file updates or interactive policy management. |
Pre-requisites:
- Use case 1 & 3 have been completed
- Hackit.exe is on the desktop of your client
Objective
The objective of this use case is to demonstrate the speed and distribution in which the Data Exchange Layer is updated. Successful completion of this use case should demonstrate the near real-time distribution that the Data Exchange Layer offers.
Step | Instructions | Image or amplifying instructions. |
Remote Desktop into the client system and run Hackit.exe. This populates the TIE reputations page. Right click the Hackit icon in the system tray and click Shutdown Hack-it Be ready to click on Hackit.exe as quickly as possible in a future step. | ||
2. | Click on Menu | Systems Section | TIE Reputations | |
3. | In the File Search tab Enter Hackit.exe in the search field and click Find Files. *Note clicking enter will not search. You must use the mouse to click the Find Files Button. | |
4. | Click the checkbox next to HackIt.exe | |
5. | Are you ready to be quick? Click Actions and mark Hackit.exe file as ‘File Most Likely Malicious’ Move to step 6 quickly | |
6. | Remote Desktop into the client system and attempt to re-run Hackit.exe. | |
7. | The execution attempt will be blocked. Note that the reputation update was immediately distributed from ePO to the TIE client over the DXL. This kind of communication typically takes less than 1 second. You can repeat the test by changing the file reputation in ePO from “File Most Likely Malicious” to “File Known Trusted”. |
Conclusion
No more waiting for agent wake up calls, slow dat releases or for the global threat feed to update! The speed and distribution of the Data Exchange Layer provides a communication fabric that allows immediate protection across your entire enterprise.
Incident Response – Patient Zero & Clean Up
Enterprise details collected from file execution allows administrators to track and gather additional information around where and when a file entered their enterprise.
Pre-requisites:
- Use case 1-4 have been completed
- Hackit.exe is on the desktop of your client
Objective
The objective of this use case is to demonstrate the incident response capabilities and data held within the TIE server. Successful completion of this use case should demonstrate how to identify when a file first entered your environment as well as how widespread the file is being executed. You will also be able to take action by triggering a VSE clean on a known malicious file.
Step | Instructions | Image or amplifying instructions. |
1. | Remote Desktop into the client system and run Hackit.exe | |
2. | Click on Menu | Systems Section | TIE Reputations | |
3. | In the File Search tab Enter Hackit.exe in the search field and click Find Files. *Note hitting enter will not search. You must use the mouse to click the Find Files Button. | |
4. | Click the checkbox next to Hackit.exe | |
5. | Click Actions | Where Has File Run | |
6. | The number of systems this file was run on will appear as well as the First Reference Date. Sort the First Reference Date column to identify patient zero | |
7. | The Management features of ePO allow the user to take appropriate action at the client when an incident arises. Click into the endpoint to show system information. The Actions button allows the user to modify the System Health settings, Tag the system, change the policy etc. | |
8. | In step 1 hackit.exe was executed. On the endpoint you will see the Hack-It interface, the Hack-It application running in Task Manager, as well as the Hack-It icon running in the system tray. | |
9. | In the Configuring the TIE solution section of this guide we set Clean at Known Malicious for the TIE module for VSE policy. In this case when a file’s Enterprise reputation is set to Known Malicious a reputation change DXL event goes out immediately. Based on this policy setting the TIE module for VSE triggers a VSE clean. A VSE clean includes looking for running processes associated with the file and terminating them. | |
10. | Let’s pretend for this demo that Hackit.exe has become a known immediate threat to our environment. Setting the file to Known Malicious will trigger a VSE clean. In the TIE Reputations page check the box next to Hackit.exe and click Actions | File Known Malicious | |
11. | Return to the endpoint and observe the Hack-It interface, the Hack-It application running in Task Manager, as well as the Hack-It icon running in the system tray have disappeared. |
Conclusion
When a compromise does occur, the knowledge gathered by the TIE server empowers admins to respond swiftly and accurately. By setting a file to known malicious the administrator can trigger a VSE clean across the entire environment while simultaneously ensuring all future encounters are cleaned.
Appendix
McAfee Advanced Threat Defense for Automated Intelligence
If a file's reputation is unknown or is not certain, you can submit it to Advanced Threat Defense for further analysis. McAfee Advanced Threat Defense detects today’s stealthy, zero-day malware with an innovative, layered approach. It combines low-touch antivirus signatures, reputation, and real-time emulation defenses with in-depth static code and dynamic, malware analysis (sandboxing) to analyze the actual behavior of malware. Combined, this represents the strongest advanced anti-malware technology in the market, and effectively balances the need for both security and performance. Files can be sent from Threat Intelligence Exchange to Advanced Threat Defense automatically based on their reputation level and file size. For additional information on ATD please take a look at our product page http://www.mcafee.com/us/products/advanced-threat-defense.aspx
If Advanced Threat Defense is present, the following steps occur (based on policy):
- Endpoints running McAfee Threat Intelligence Exchange can inspect files on execution. If that inspection is inconclusive, the file can be sent to McAfee Advanced Threat Defense for further analysis.
Note: The file is actually sent from the endpoint to the TIE server, and then the TIE server sends the file to ATD.
- After analysis, McAfee Advanced Threat Defense will publish the file’s reputation to the DXL. At that point, the endpoint (and all other products on the DXL) will be notified if it is malicious.
Pre-requisites:
- ATD is configured in the TIE Server Management Policy.
Note: This configuration was implemented earlier in this document
- Download the set of test samples provided here: http://mcaf.ee/yiuva
For this use case we will be using Artemis-Unknown-All.exe
Objective
The objective of this guide is to demonstrate automation capabilities when integrating with McAfee Advanced Threat Defense. ATD eliminates the need for administrators to review file executions in ePO. It further eliminates the need to make decisions about whether the file is good or bad by making the determination and then publishing the reputation to the DXL – all with zero administrator involvement. Successful completion of this use case should demonstrate any ATD conviction will automatically immunize your entire environment.
Step | Instructions | Image or amplifying instructions. | |
1. | To access the TIE Server settings policy, select Menu | Policy |Policy Catalog and select McAfee TIE Server Management 1.0.0 in the Product dropdown. Click into My Default to edit. | ||
2. | |||
3. | To access the TIE Client policy, select Menu | Policy |Policy Catalog and select Threat Intelligence Exchange Module for VSE 1.0.0 in the Product dropdown. | ||
4. | Check submit files to ATD at Unknown | ||
5. | In TIE Reputations click Actions, Choose Columns Add ATD Reputation and click Save | ||
6. | On your endpoint execute Artemis-Unknown-All.exe. This sample will be sent to ATD because it has an unknown reputation and we set the policy to send to ATD if files have an unknown reputation. | ||
7. | The sample file will be sent from the client to the TIE server. The TIE Server then submits the sample to ATD. In ATD you will see Artemis-Unknown-All.exe | ||
8. | Wait for the file to be analyzed. The ATD Analysis Results will expose the sample results as well as the reason. | ||
9. | In ePO under TIE Reputations you will see the Known Malicious reputation determined by ATD. | ||
Conclusion
McAfee Advanced Threat Defense connects your security ecosystem by sharing reputation information over the DXL. When an administrator does not want the hassle of researching each unknown or risky file McAfee ATD can offload that responsibility. ATD also improves the efficiency of your security ecosystem. Sharing reputation information means that all future encounters of a file will already have a reputation and will not have to be analyzed again.
VirusTotal
VirusTotal (https://www.virustotal.com) is a free service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware. With a very large database of highly regarded information McAfee TIE has integrated this 3rd party feed as the first of our integrations.
In order to take advantage of the VirusTotal integration you will need a private or public API key. Public Keys are free. To obtain your public key take the following steps.
Step | Instructions | Image or amplifying instructions. |
1. | You do not need to ask for a public API key, in order to get one you just have to register in the VirusTotal Community. | https://www.virustotal.com/en/#signup |
2. | Fill in the required registration information. Click Sign up. | |
3. | You will receive a confirmation screen advising an e-mail was sent. Click Close | |
4. | The e-mail received will appear as follows. Click the activation link | |
5. | You will receive a confirmation screen Click Sign in | |
6. | Enter Username and password Click Sign in. | |
7. | Once you are successfully logged in click your username in the upper right corner. Click My API key | |
8. | Note your API Key to configure TIE to gain access. This API Key is used in the TIE Server Configuration. | |
9. | A public API key comes with the following properties. You may learn more about its functionality in the public API documentation |
Baseline Gold Images with the TIE Scanner
The TIE Scan tool performs TIE analysis on user-specified files and folders, and populates a TIE server database. The Tie Scanning tool is not an official part of the product and comes with minimal/no support or documentation.
Pre-requisites:
- The endpoint must contain the McAfee Agent 5.0 and be connected to the TIE Server over DXL.
- TIEScanner.exe included in the package
Objective
The objective of this use case is to populate the TIE server with files already known to the environment to establish a baseline.
Step | Instructions | Image or amplifying instructions. | |
1. | Place TIEScanner.exe on the gold image that you would like to use for your baseline. | ||
2. | A pop-up requests a location of the extracted files. Browse and click OK when done. Several files will be extracted to this location. For additional information review the ReadMeTieScan.txt | ||
3. | Open a command prompt, navigate to the folder you extracted to in the last step and run: TIEScan <file|folder> [/recurse] | ||
4. | Depending on the size of the directory the scan could take several hours. When complete the TIE Scanning tool will detach. At this point the scan is complete. | ||
Troubleshooting
Troubleshoot the installation
If you experience problems installing and accessing the Threat Intelligence Exchange module for VirusScan Enterprise, server, or the Data Exchange Layer client, follow these steps:
1. | In McAfee ePO, click Menu | System Tree, then select the checkbox for the Threat Intelligence Exchange server. |
2. | Click Wake Up Agents On the Wake Up McAfee Agent page, select the checkbox Force complete policy and task update, then click OK. This sends the server properties from the Threat Intelligence Exchange appliance to McAfee ePO. |
3. | Verify that this task completed in the server task log |
4. | In the System Tree, click the server name, then click the Products tab. Verify that the following products are listed: • McAfee DXL Broker • McAfee DXL Client • McAfee Threat Intelligence Exchange Server |
5. | Click Menu | Automation | Server Tasks and run the task: Apply TIESERVER tags to TIE Server In the System tree, verify that the TIESERVER tag has been applied to the system. |
6. | Click Menu | Automation | Server Tasks and run the task: Manage DXL Brokers In the System Tree, verify that the DXLBROKER tag has been applied to the system. |
7. | After the tags have been successfully applied, click System Tree, select the Threat Intelligence Exchange server, then click Wake Up Agents. |
8. | On the Wake Up McAfee Agent page, select the checkbox Force complete policy and task update, then click OK. |
9. | Verify that this task completed in the server task log |
10. | Click Menu | Configuration | Server Settings, then click DXL Client for ePO. Verify that the Connection State is Connected. |
11. | To verify that the DXL and TIE services are running, on the virtual machine open a Console window, log in and enter service dxlbroker status then enter service tieserver status You should see both services running. |
12. | In the System Tree, select the Threat Intelligence Exchange server and from the Actions menu, click DXL | Lookup in DXL. Verify that the Connection State is Connected |
Logfiles
Threat Intelligence Exchange server: /var/McAfee/tieserver/logs/tieserver.log
Threat Intelligence Exchange module for VirusScan Enterprise: %programdata%\McAfee\TIEM
Data Exchange Layer Client: %programdata%\McAfee\Data_eXchange_Layer
Data Exchange Layer Broker: /var/McAfee/dxlbroker/logs/dxlbroker.log
Reconfiguring using scripts
Scripts are available to reconfigure the Threat Intelligence Exchange server, Data Exchange Layer brokers, and the McAfee Agent.
Accessing the scripts
The scripts are located in the /home/<username> directory. They must be executed with sudo permissions, for example sudo /home/myname/change‑hostname.
1
Related Articles
How to use the Threat Intelligence Exchange Server MER tool
Environment McAfee Minimum Escalation Requirements (MER) tool for Threat Intelligence Exchange (TIE) Server McAfee TIE Server 2.3.x, 2.1.x, 2.0.x, 1.3.x Summary Run the MER tool To run the MER tool for TIE Server, switch to the Root user, type the ...How to automate and schedule SQL Server index defragmentation
Introduction SQL Server maintenance is not a one-time event, but rather a part of a continuous process. Apart from regular backups and integrity checks, performance improvements can be achieved with index maintenance. If done at regular intervals, it ...EE020006 Endpoint Encryption Disk information not found (when booting from DETech using the Standalone USB version)
Environment McAfee Drive Encryption (DE) 7.x For details of DE supported environments, see KB79422. Problem If you boot a system that is encrypted from a USB DETech standalone recovery media, it fails to authenticate. If you click any of the ...EE0F0001 Token authentication parameters are incorrect (unable to unlock the computer)
Environment McAfee Drive Encryption (DE) 7.1.x McAfee Endpoint Encryption for PC (EEPC) 7.0.x For details of DE 7.1.x supported environments, see KB79422. For details of EEPC 7.0.x supported environments, see KB76804. Problem After resetting the ...EE0F0001 Token authentication parameters are incorrect (unable to unlock the computer) Technical Articles ID: KB73697
Environment McAfee Drive Encryption (DE) 7.1.x McAfee Endpoint Encryption for PC (EEPC) 7.0.x For details of DE 7.1.x supported environments, see KB79422. For details of EEPC 7.0.x supported environments, see KB76804. Problem After resetting the ...