Authorization of Sus files/behaviour

Hi,

I always turn to the database for this sort of information.  I would suggest installing a copy of Microsoft SQL Server Management Studio (http://www.microsoft.com/downloads/details.aspx?FamilyID=08e52ac2-1d62-45f6-9a4a-4b76a8564a2b&displaylang=en) on a machine on the network and connect to the Sophos database instance.  

You could use OSQL.exe command line tool but the output format isn't too great and I tend to look in the database quite a bit for reports.  

Once in SQL Studio, choose the SOPHOS4 database from the drop down and run the following command against the SOPHOS4 database:

Select c.name as computerName, t.ThreatName, t.ThreatType, t.Checksum, t.FileVersion, t.FullFilePath, t.FirstDetectedAt from dbo.ThreatInstancesAll as t inner join dbo.computersanddeletedcomputers as c with (nolock) on c.id = t.computeridwhere t.threattype=5

where threattype could be for example:
1 = Virus

2 = Adware/PUA

4 = HIPS

5 = Sus

This should help you find what you need and by adjusting the where clause for various things and threattype you should be able to find most data.  I used the view ThreatInstancesAll rather than the 2 tables Threats and ThreatsArchive that make up the view as I don't know if this is an outstanding alert or not for you.

I hope this helps you.

Jak

PS, if you can't install the MS SQL Studio, running this command will do it,  I've assumed you have a SOPHOS named instance and you would run this on the machine where the database resides.

OSQL -E -S .\sophos -d SOPHOS4 -Q "Select c.name as computerName, t.ThreatName, t.ThreatType, t.Checksum, t.FileVersion, t.FullFilePath, t.FirstDetectedAt from dbo.ThreatInstancesAll as t inner join dbo.computersanddeletedcomputers as c with (nolock) on c.id = t.computeridwhere t.threattype=5" -o C:\threatsSus.txt -w 1000

This will create a file called C:\threatsSus.txt, you can either search for the filename or the checksum.

Hi,

I always turn to the database for this sort of information.  I would suggest installing a copy of Microsoft SQL Server Management Studio (http://www.microsoft.com/downloads/details.aspx?FamilyID=08e52ac2-1d62-45f6-9a4a-4b76a8564a2b&displaylang=en) on a machine on the network and connect to the Sophos database instance.  

You could use OSQL.exe command line tool but the output format isn't too great and I tend to look in the database quite a bit for reports.  

Once in SQL Studio, choose the SOPHOS4 database from the drop down and run the following command against the SOPHOS4 database:

Select c.name as computerName, t.ThreatName, t.ThreatType, t.Checksum, t.FileVersion, t.FullFilePath, t.FirstDetectedAt from dbo.ThreatInstancesAll as t inner join dbo.computersanddeletedcomputers as c with (nolock) on c.id = t.computeridwhere t.threattype=5

where threattype could be for example:
1 = Virus

2 = Adware/PUA

4 = HIPS

5 = Sus

This should help you find what you need and by adjusting the where clause for various things and threattype you should be able to find most data.  I used the view ThreatInstancesAll rather than the 2 tables Threats and ThreatsArchive that make up the view as I don't know if this is an outstanding alert or not for you.

I hope this helps you.

Jak

PS, if you can't install the MS SQL Studio, running this command will do it,  I've assumed you have a SOPHOS named instance and you would run this on the machine where the database resides.

OSQL -E -S .\sophos -d SOPHOS4 -Q "Select c.name as computerName, t.ThreatName, t.ThreatType, t.Checksum, t.FileVersion, t.FullFilePath, t.FirstDetectedAt from dbo.ThreatInstancesAll as t inner join dbo.computersanddeletedcomputers as c with (nolock) on c.id = t.computeridwhere t.threattype=5" -o C:\threatsSus.txt -w 1000

This will create a file called C:\threatsSus.txt, you can either search for the filename or the checksum.