Jump to content

MBR Filter

Recommended Posts

MBR Filter

MBR Filter is a simple disk filter designed by Cisco Talos to block write access to the Master Boot Record (MBR). The MBR is used to store information related to how the storage device is partitioned, as well as details regarding the filesystem configuration on the device. MBR Filter prevents rootkits, bootkits, and ransomware, such as Petya Ransomware, from overriding the operating system’s (OS) boot loader. Ransomware, like Petya, overwrite and encrypt the victim’s Master File Table (MTF) to coerce them into paying for an encryption key.

MBR Filter, once installed, requires the system to boot in Safe Mode to enable write access to make changes to the device. This prevents malicious software from writing to or modifying the contents of this section of the machine or any disks connected to the system. MBR Filter enables users to effectively protect their systems from various malware families and disrupts the operations of cyber criminals, making their malware ineffective. Talos offers the MBR Filter in two formats usable on Windows based systems: open source which can be used and modified by anyone and a precompiled, signed driver executable that can be installed.

MBRFilter has been intentionally made difficult to remove to prevent malware from simply disabling or removing this protection during the infection process. Test thoroughly before deploying within production environments.

*Note - This tool is not officially supported and the user assumes all liability for the use of this tool.

Sursa: https://talosintelligence.com/mbrfilter

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...