W32.Bugbear

Question

Hey folks, a few caveats here, I'm fairly new to LEM, and we have some old hosts.

That being said, does anyone have any ideas how I could use LEM to track down the source of a W32.Bugbear infection or if it's possible to use the tool for something like that?

Kind Regards,

EP

curtisi · Accepted Answer

I don't know that we can track down the source, but we could (hypothetically) create a rule that would alert when the behavior of the virus (or any virus) is detected.

I made an example: W32.Bugbear Detection Rule