This is the latest release of Trellix Malware Analysis
New features and changes
This section describes new features in Trellix Malware Analysis release 11.0.0.
Support OS Upgrade to Alma Linux 9.2
The Malware Analysis platform has undergone a base upgrade from CentOS 7 to Alma Linux 9.2 to ensure continuous support and deliver improved stability, security, and performance.
Malware Repository Analysis supports enabling/disabling VNC through the WebUI and CLI
The Malware Repository Analysis feature now supports the enabling and disabling of Virtual Network Computing (VNC) sessions directly through the WebUI and CLI. This functionality allows users to automate the initiation of VNC sessions for all malware repository submissions, regardless of whether they are initiated from the WebUI or CLI.
Integration with private Global Threat Intelligence (pGTI)
The Malware Analysis appliance now supports Private Global Threat Intelligence (pGTI) integration, enabling it to leverage Trellix's private cloud server for URL and file reputation verdicts. pGTI, which uses REST APIs and certificate-based authentication, maintains reputations based on Trellix security platform submissions. Malware Analysis can now query pGTI for file and URL reputation assessments during analysis.
Support provided for custom IOC feed implementation through the Web UI
Enhancements have been implemented to the Malware Analysis Web UI, enabling the inclusion of URLs, MD5 or SHA-256 hashes, and regex URLs within both allowed and blocked lists. These additions are designed to optimize the appliance's detection efficacy and expedite analysis times.
Integration of external threat intelligence feeds through the TAXII protocol.
Malware Analysis now integrates third-party threat intelligence feeds from TAXII servers using STIX 2.x/TAXII 2.1 via the web UI and CLI. Upon configuration, the system automatically retrieves feeds, including URLs and file hashes, at scheduled intervals based on the configured synchronization frequency. Currently, Malware Analysis supports the configuration of a single TAXII server, with customizable API roots, credentials, CA certificates, synchronization frequency, and STIX indicator types.
Important
For more details, see "Managing threat intel feeds using TAXII".
Custom URL rules now support regex pattern matching
Regular expression pattern matching is now supported for custom blocklists and allowlists, enhancing the ability to define URL rules. This enhancement provides increased flexibility for improved threat management via both the Command Line Interface (CLI) and the Web User Interface (WebUI).
Improved Third-Party Feed management capabilities
The 3rd Party Feeds page, formerly exclusive to Malware Analysis, is now extended to the Central Management System. This enhancement allows users to add, view, and download feeds from the Web UI of either product. Additionally, new Allowed Lists and Blocked Lists sub-tabs are implemented in both products. These tabs enable the management of entries, including the ability to add, view, update, and delete based on URL, MD5sum, SHA256, and Regex URL criteria.
Malware Analysis now offers full analysis of Dropper Files
Enhanced file analysis by processing dropper files with built-in safeguards against infinite execution. Implement a submission-level threshold to limit the number of dropper files undergoing full analysis (default: 1). Exceeding this threshold will exclude subsequent dropper files from comprehensive analysis. Additionally, perform Domain Under Analysis (DUA) on URLs extracted during Dynamic Analysis (DA).
New CLI commands
The CLI commands in this section were added in this release.
CLIs to enable VNC for malware repositories
malware file repository shared-point vnc enable: Enables VNC mode for malware submissions.
Regex pattern matching in custom URL rules CLIs
[no] analysis custom blacklist regex url <pattern>: Adds a rule to a custom blacklist based on the regex URL with specified pattern.[no] analysis custom whitelist regex url <pattern>: Adds a rule to a custom whitelist based on the regex URL with specified pattern.show analysis custom blacklist regex urls: Displays the custom blacklist containing all the regex URLs.show analysis custom whitelist regex urls: Displays the custom whitelist containing all the regex URLs.
CLIs for managing threat intel feeds - TAXII
[no] taxii server <TAXII server name> api-root: Configures the API root for the TAXII server.[no] taxii server <TAXII server name>: Configures a TAXII server.[no] taxii server <TAXII server name> api-root collection-id: Configures the API root with a collection ID for the TAXII server.[no] taxii server<TAXII server name> api-root username password: Configures the API root username and password for the TAXII server.[no] taxii server <TAXII server name> discovery-url: Configures the TAXII server discovery URL.[no] taxii server <TAXII server name>enable: Enables the TAXII server.[no] taxii server <TAXII server name> pagination-limit: Configures the pagination limit for the TAXII server.[no] taxii server<TAXII server name> root-ca: Configures the root CA for the TAXII server.[no] taxii server <server name> root-ca ca-chain: Configures the root CA and CA chain for the TAXII server.[no] taxii server <TAXII server name> sync-frequency: Set the TAXII server sync frequency in minutes (10-1440).[no] taxii server <TAXII server name> username password: Configure the TAXII server username and password.[no] taxii server <TAXII server name> validate config: Validates the TAXII server configuration.[no] show taxii server: Displays the configuration of a TAXII server.[no]analysis custom stix indicator-type <type> enable: Enables the indicator type for STIX format intel feeds. Only the configured indicator patterns with indicator-type configured are synced.
CLIs for pGTI integration
analysis pgti baseurl <pgti_url>: Configures the URL address of the pGTI serverno analysis pgti baseurl: Deletes the URL address of the pGTI serveranalysis pgti apikey certificate <cert_name> ca-list <ca-chain-cert_name>: Generates the API key for communicating with the pGTI server using the APIno analysis pgti apikey: Deletes the pGTI API key and the corresponding certificate name and ca_chain name config used for generating the certificates[no] analysis pgti enable: Enables/disables the integration with the pGTI servershow analysis pgti: Displays the configuration details regarding the pGTI integration
Resolved issues
The following issues were resolved in the Malware Analysis 11.0.0 release.
Tracking number | Summary |
|---|---|
COM-62823 | In the latest OS version, the 'ping' command response for non-registered hosts has changed from "unknown host" to the more generic "system error" to improve security hardening. |
COM-62576 | When a URL is added to the custom blacklist, AX now automatically considers both HTTP and HTTPS versions of the URL. This ensures consistent behavior by handling both protocol variations during subsequent blacklist processing. |
COM-62287 | The JAR versions have been updated to the latest to address multiple CVEs. |
COM-31520, COM-31516 | Vulnerability Validation for CVE-2023-5869 Resolution for the vulnerability designated as CVE-2023-5869 was implemented in PostgreSQL 14.10 binaries. In the present release, version 11.0.0, PostgreSQL 14.11 is deployed, thereby incorporating the necessary fixes from version 14.10 and effectively mitigating the aforementioned vulnerability. |
COM-31445 | Malware Analysis is not vulnerable for CVE-2023-38545 and CVE-2023-38546. |
COM-30996 | The issue where the backup process using SCP functionality failed to finalize has been resolved by upgrading OpenSSH to version 9.8p1 on the Alma OS. |
MAS- 4100 | Fixes the API call-related errors occurred after executing the fenotify preferences runtime sys-reset command. |
Known issues
The following issues are known in the Malware Analysis 11.0.0 release.
Tracking number | Summary |
|---|---|
MAS-4149 | Instead of originating from the designated live interface (ether2), the sandbox analysis traffic is incorrectly originating from the management interface (ether1). |
WEBUI-14964 | The STIX feed upload should accept only valid STIX 1.0 (XML) and STIX 2.0/2.1 (JSON) formats. The current implementation incorrectly allows other file formats to be uploaded. |
Upgrade support
The Trellix Malware Analysis 11.0.0 release requires a reboot for the update to take effect. You can upgrade your AX appliance to 11.0.0 from release 9.1.0 or later.
After an upgrade to version 11.0.0, the dashboard will not retain prior data for Analysis Statistics and File Analysis Statistics.
After an upgrade to version 11.0.0, the dashboard statistics may may exhibit inaccuracies for the initial three-hour period. Scan statistics remain unaffected.
Previously created log archive files shall not be preserved during an upgrade to 11.0.0. It is recommended to secure a backup of logs before initiating the upgrade.
After any upgrade to 11.0.0, the FireEye Advanced URL Defense Engine (FAUDE) will be activated if it was previously disabled in earlier versions. See "Enabling or Disabling Advanced URL Defense" in the Malware Analysis User Guide.
After upgrading to version 11.0.0, certain system processes may remain in a pending state until the latest security content has been successfully downloaded and installed. See the following section, "Download the security content bundle".
Download the security content bundle
After the upgrade, certain processes will be in a pending state until new security content is downloaded and installed. The security content is downloaded and installed automatically for online customers. Offline customers must manually download and install the new security content after upgrading appliances to release 11.0.0.
Downloading content from the DTI offline update portal
If acquiring Malware Analysis 11.0.0 security content from the DTI Offline Update Portal, utilization of the SCNET-9.0 channel is mandatory.
Caution
Deviation from this specific channel for security content retrieval will invariably precipitate a compromise in detection capabilities.
For details, see the Trellix DTI Offline Update Portal User Guide.
Upgrading IPMI 3.11 and BIOS 1.9 firmware for specific platforms
YARA rules supported versions
YARA rule support has been updated to version 4.5.0. Prior to upgrading a Malware Analysis appliance to release 11.0.0, it is necessary to modify any custom YARA rules to comply with YARA 4.5.0. For detailed information regarding YARA 4.5.0, see YARA's Documentation, Release 4.5.0 by Victor Alvarez.