I’m still using profiles based on the ‘Hardened windows profile’ for all my devices.
This after a client wast infected twice with ransomware using the endpoint client.
I tought that the ‘Hardened profile’ should detect a lot of malware/phishing codes.
But what struck me is the following:
Lately I see a lot of anti phishing activities.
A client received a phishing email and opened the attached link.
It leaded to a fake webpage.
He/or I, didn’t receive a message regarding a fake website or blocked code.
But… the same client also had a private laptop with him where Bitdefender Free was installed.
And Bitdefender did detect the phishing code, blocked it and warned the user.
My question:
How come that XCitium isn’t blocking this and a free antivirus like Bitdefender is?
How can I achieve this level of detection and warning with the XCitium client? My client feels that a free antivirus protects him better than an enterprise classed, paid product…
I have been speaking to @ilgazy at Xcitium on this and will get him to place something public here.
From my discussions with him, please bear in mind that the profiles default is to not display information to the end user like you have experienced from Bitdefender. In theory the file should have been blocked as it was an “unknown” file and should list in the logs for the AV inside Endpoint Manager and directly on the device in the AV control panel.
I obviously do not have the logs for your portal and cannot comment on the status of this being blocked or not, but I can let you know that you can inside your portal turn on client side warnings as shown in the below image.
It’s correct that a lot of warnings are not displayed by default.
And that’s why I was counting that the attached link to the phishing site was blocked.
But no, a few clients did open the link and the page of the false website was presented.
I tried the same test also on my machines.
And of course I enabled all the warnings:
Would you like to share your profile with us?
If not, maybe screenshots of the relevant modules in your config template?
It would be great if there’s a subgroup on this forum where profile tips could be shared or posted.
(but that’s something I already opted a few years ago…)
Hope to hear which option(s) I have to configure to detect these phishing links/ sites/ scripts.
If you share your profile here, I’ll take a look at the settings for you.
I’m also attaching an extract from my XCS logs showing the file being quarantined.
