Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Sophos Firewall

Discussions Block Impacket, psexec, Windows RCE

Sophos Firewall requires membership for participation - click to join

Thread Info

State Suggested Answer
Locked Locked
Replies 2 replies
Answers 1 answer
Subscribers 40 subscribers
Views 1319 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Block Impacket, psexec, Windows RCE

MMASLOUH7 4 months ago

Hello,

Im doing some POC to chose the best firewall that have a good NGIPS.

The default IPS profile was not able to block Impacket, psexec or any other Windows RCE.

How can i made the IPS policy more strict for a LAN to LAN policy.

This thread was automatically locked due to age.

Top Replies

Vivek Jagad 4 months ago +1 suggested

Hi MMASLOUH7 , Thank you for reaching out to the community, you can Custom IPS signatures .

0 Vivek Jagad 4 months ago

Hi MMASLOUH7 ,
Thank you for reaching out to the community, you can Custom IPS signatures.

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel
0 MMASLOUH7 4 months ago in reply to Vivek Jagad

So, Sophos IPS can't block Windows known RCE vulnerabilities like CVE-2017-0144, CVE-2021-1675, CVE-2020-1472, etc
Cancel
Vote Up -1 Vote Down

Cancel