Web Gateway 7.1.5 Product Guide - McAfee

Web filtering
Virus and malware filtering 6
Block the Following Behavior
Settings for selecting code behavior that leads to blocking
Data theft: Backdoor — When selected, the following is blocked: Malicious applications that grant an
attacker full remote access and control to a victim’s system through existing or newly created network
channels
Data theft: Keylogger — When selected, the following is blocked: Malicious applications that hook
into the operating system to record and save keyboard strokes
The captured information, such as passwords, is sent back to the attacking party
Data theft: Password stealer — When selected, the following is blocked: Malicious applications that
gather, store, and leak sensitive information, such as the system configuration, confidential data,
credentials, and other data for user authentication
System compromise: Code execution exploit — When selected, the following is blocked: Exploits
for vulnerabilities in any client applications, such as browsers, office programs, or multi-media players,
that could allow an attacker to run arbitrary code on the compromised system
System compromise: Browser exploit — When selected, the following is blocked: Exploits for
vulnerabilities in browser applications and plug-ins that could allow the attacker to run arbitrary code,
steal sensitive data, or escalate privileges
System compromise: Trojan — When selected, the following is blocked: Malicious applications that
pretend to be harmless or useful, but actually perform malicious activities
Stealth activity: Rootkit — When selected, the following is blocked: Malicious applications or device
drivers that manipulate the operating system and hide presence of malware on infected systems
After the compromise, files, registry keys, and network connections belonging to the malware
processes turn invisible and could be hard to recover
Viral Replication: Network worm — When selected, the following is blocked: Malicious applications
or device drivers that self-replicate using email, the internet, peer-to-peer networking, or by copying
themselves onto removable media such as USB devices
Viral Replication: File infector virus — When selected, the following is blocked: Self-replicating
applications that infect existing files on the hard-disk, embedding viral code in order to spread through
the newly infected host file
System compromise: Trojan downloader — When selected, the following is blocked: Malicious
applications or script code that download and execute additional payload from the internet
System compromise: Trojan dropper — When selected, the following is blocked: Malicious
applications that carry hidden payload, extract and launch it upon execution
System compromise: Trojan proxy — When selected, the following is blocked: Malicious
applications that allow to relay potentially malicious hidden network activity through the compromised
system
Web threats: Infected website — When selected, the following is blocked: Websites that contain
injected malicious script code or request additional malicious code as soon as it is opened in a browser
The initial infection might have taken place through an SQL injection attack against the web server.
Stealth activity: Code injection — When selected, the following is blocked: Applications that copy
their code into other, often legitimate processes, resulting in a hijacking of the respective privileges and
trust
This technique is typically employed by malware that tries to hide its presence on compromised
systems and tries to evade detection.
Detection evasion: Obfuscated code — When selected, the following is blocked: Applications that
consist of highly scrambled of encrypted code
Detection evasion: Packed code — When selected, the following is blocked: Applications whose
content has been compressed by a run-time packer or protector
Applying a run-time packer to an application changes the way it looks so it is harder to it is harder to
classify.
McAfee Web Gateway 7.1.5 Product Guide 185